CVE-2013-4315: Django Directory Traversal via ssi… – CVSS 5.0 · Watchpost

← All vulnerabilities

Django Directory Traversal via ssi template tag

MEDIUM 5.0CVE-2013-4315 · GHSA-vjjp-9r83-22rc · PYSEC-2013-20 · Published 16/09/2013 · updated 16/06/2026

In short

CVE-2013-4315 is a MEDIUM (CVSS 5.0) vulnerability affecting django, django (djangoproject).
Chance of exploitation in the next 30 days (EPSS): 3.2%, higher than 88.2% of all vulnerabilities.
Fix: update to 1.4.7, 1.5.3 or later.

Package	Affected versions	Patched versions
django PyPI	`≥ 1.4, < 1.4.7≥ 1.5, < 1.5.3`	`1.4.71.5.3`
django djangoproject	`= 1.4= 1.4.1= 1.4.2= 1.4.4= 1.4.5= 1.4.6= 1.5= 1.5.1= 1.6`	No fix yet

Description

Directory traversal vulnerability in Django 1.4.x before 1.4.7, 1.5.x before 1.5.3, and 1.6.x before 1.6 beta 3 allows remote attackers to read arbitrary files via a file path in the ALLOWED_INCLUDE_ROOTS setting followed by a .. (dot dot) in a ssi template tag.

NVD description

Directory traversal vulnerability in Django 1.4.x before 1.4.7, 1.5.x before 1.5.3, and 1.6.x before 1.6 beta 3 allows remote attackers to read arbitrary files via a file path in the ALLOWED_INCLUDE_ROOTS setting followed by a .. (dot dot) in a ssi template tag.

References

nvd.nist.gov/vuln/detail/CVE-2013-4315 · ADVISORY
django/django commit 87d2750 · WEB
django/django commit 988b61c · WEB
django/django · PACKAGE
pypa/advisory-database · WEB
djangoproject.com/weblog/2013/sep/10/security-releases-issued · WEB
lists.opensuse.org/opensuse-updates/2013-10/msg00015.html · WEB
rhn.redhat.com/errata/RHSA-2013-1521.html · WEB
debian.org/security/2013/dsa-2755 · WEB
secunia.com/advisories/54772 · Vendor Advisory
secunia.com/advisories/54828 · Vendor Advisory
djangoproject.com/weblog/2013/sep/10/security-releases-issued

More vulnerabilities in django

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free