CVE-2021-33203

Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by application developers to also show file contents, then not only the existence but also the file contents would have been exposed. In other words, there is directory traversal outside of the template root directories.

• CWE-22

• https://docs.djangoproject.com/en/3.2/releases/security/Patch, Vendor Advisory
• https://groups.google.com/forum/#%21forum/django-announce
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/
• https://security.netapp.com/advisory/ntap-20210727-0004/Third Party Advisory
• https://www.djangoproject.com/weblog/2021/jun/02/security-releases/Patch, Vendor Advisory
• https://docs.djangoproject.com/en/3.2/releases/security/Patch, Vendor Advisory
• https://groups.google.com/forum/#%21forum/django-announce
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/
• https://security.netapp.com/advisory/ntap-20210727-0004/Third Party Advisory
• https://www.djangoproject.com/weblog/2021/jun/02/security-releases/Patch, Vendor Advisory

Published

Jun 8, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-33196In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5…7.5
• CVE-2021-33197In Go before 1.15.13 and 1.16.x before 1.16.5, some configur…5.3
• CVE-2021-33198In Go before 1.15.13 and 1.16.x before 1.16.5, there can be …7.5
• CVE-2021-33199In Expression Engine before 6.0.3, addonIcon in Addons/file/…9.8
• CVE-2021-3320Type Confusion in 802154 ACK Frames Handling. Zephyr version…7.5
• CVE-2021-33200kernel/bpf/verifier.c in the Linux kernel through 5.12.7 enf…7.8
• CVE-2021-33204In the pg_partman (aka PG Partition Manager) extension befor…9.8
• CVE-2021-33205Western Digital EdgeRover before 0.25 has an escalation of p…8.8
• CVE-2021-33207The HTTP client in MashZone NextGen through 10.7 GA deserial…9.8
• CVE-2021-33208The "Register an Ehcache Configuration File" admin feature i…7.2
• CVE-2021-33209An issue was discovered in Fimer Aurora Vision before 2.97.1…5.3
• CVE-2021-3321Integer Underflow in Zephyr in IEEE 802154 Fragment Reassemb…8.8