CVE-2024-39330: Django CVE-2024-38875, CVE-2024-39329, CVE-2024-39330, and CVE-2024-39614

An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. Derived classes of the django.core.files.storage.Storage base class, when they override generatefilename() without replicating the file-path validations from the parent class, potentially allow directory traversal via certain inputs during a save() call. (Built-in Storage sub-classes are unaffected.)

— NVD

Derived classes of the django.core.files.storage.Storage base class which override generatefilename() without replicating the file path validations existing in the parent class, allow for potential directory-traversal via certain inputs when calling save(). Built-in Storage sub-classes were not affected by this vulnerability.

Affected versions =================

Django main development branch Django 5.1 Django 5.0 Django 4.2

— Red Hat

Django could allow a remote attacker to traverse directories on the system, caused by improper validation of user request. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

— IBM