CVE-2013-4315

Directory traversal vulnerability in Django 1.4.x before 1.4.7, 1.5.x before 1.5.3, and 1.6.x before 1.6 beta 3 allows remote attackers to read arbitrary files via a file path in the ALLOWED_INCLUDE_ROOTS setting followed by a .. (dot dot) in a ssi template tag.

• CWE-22

• http://lists.opensuse.org/opensuse-updates/2013-10/msg00015.html
• http://rhn.redhat.com/errata/RHSA-2013-1521.html
• http://secunia.com/advisories/54772Vendor Advisory
• http://secunia.com/advisories/54828Vendor Advisory
• http://www.debian.org/security/2013/dsa-2755
• https://www.djangoproject.com/weblog/2013/sep/10/security-releases-issued/Patch, Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2013-10/msg00015.html
• http://rhn.redhat.com/errata/RHSA-2013-1521.html
• http://secunia.com/advisories/54772Vendor Advisory
• http://secunia.com/advisories/54828Vendor Advisory
• http://www.debian.org/security/2013/dsa-2755
• https://www.djangoproject.com/weblog/2013/sep/10/security-releases-issued/Patch, Vendor Advisory

Published

Sep 16, 2013

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-4309Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2013-4310Apache Struts 2.0.0 through 2.3.15.1 allows remote attackers…
• CVE-2013-4311libvirt 1.0.5.x before 1.0.5.6, 0.10.2.x before 0.10.2.8, an…
• CVE-2013-4312The Linux kernel before 4.4.1 allows local users to bypass f…
• CVE-2013-4313Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.…
• CVE-2013-4314The X509Extension in pyOpenSSL before 0.13.1 does not proper…
• CVE-2013-4316Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method …
• CVE-2013-4317In Apache CloudStack 4.1.0 and 4.1.1, when calling the Cloud…
• CVE-2013-4318File injection vulnerability in Ruby gem Features 0.3.0 allo…5.4
• CVE-2013-4319pbs_mom in Terascale Open-Source Resource and Queue Manager …
• CVE-2013-4320The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.9…
• CVE-2013-4321The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8…