The django.utils.archive.extract() function, used by startapp --template and startproject --template, allowed directory-traversal via an archive with absolute paths or relative paths with dot segments.
The django.utils.archive.extract() function, used by startapp --template and startproject --template, allowed directory-traversal via an archive with absolute paths or relative paths with dot segments.
https://www.djangoproject.com/weblog/2021/feb/01/security-releases/ https://github.com/django/django/commit/02e6592835b4559909aa3aaaf67988fef435f624
Vulmon