CVE-2021-3281

In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments.

• CWE-22

• https://docs.djangoproject.com/en/3.1/releases/security/Patch, Vendor Advisory
• https://groups.google.com/forum/#%21forum/django-announce
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YF52FKEH5S2P5CM4X7IXSYG67YY2CDOO/
• https://security.netapp.com/advisory/ntap-20210226-0004/Third Party Advisory
• https://www.djangoproject.com/weblog/2021/feb/01/security-releases/Vendor Advisory
• https://docs.djangoproject.com/en/3.1/releases/security/Patch, Vendor Advisory
• https://groups.google.com/forum/#%21forum/django-announce
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YF52FKEH5S2P5CM4X7IXSYG67YY2CDOO/
• https://security.netapp.com/advisory/ntap-20210226-0004/Third Party Advisory
• https://www.djangoproject.com/weblog/2021/feb/01/security-releases/Vendor Advisory

Published

Feb 2, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-32804The npm package "tar" (aka node-tar) before versions 6.1.1, …8.1
• CVE-2021-32805Flask-AppBuilder is an application development framework, bu…6.1
• CVE-2021-32806Products.isurlinportal is a replacement for isURLInPortal me…6.1
• CVE-2021-32807The module `AccessControl` defines security policies for Pyt…7.2
• CVE-2021-32808ckeditor is an open source WYSIWYG HTML editor with rich con…5.4
• CVE-2021-32809ckeditor is an open source WYSIWYG HTML editor with rich con…5.4
• CVE-2021-32810crossbeam-deque is a package of work-stealing deques for bui…9.8
• CVE-2021-32811Zope is an open-source web application server. Zope versions…7.2
• CVE-2021-32812Monkshu is an enterprise application server for mobile apps …6.1
• CVE-2021-32813Traefik is an HTTP reverse proxy and load balancer. Prior to…8.1
• CVE-2021-32814Skytable is a NoSQL database with automated snapshots and TL…8.1
• CVE-2021-32815Exiv2 is a command-line utility and C++ library for reading,…5.5