CVE-2024-39330

An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. Derived classes of the django.core.files.storage.Storage base class, when they override generate_filename() without replicating the file-path validations from the parent class, potentially allow directory traversal via certain inputs during a save() call. (Built-in Storage sub-classes are unaffected.)

• CWE-22

• https://docs.djangoproject.com/en/dev/releases/security/Vendor Advisory
• https://groups.google.com/forum/#%21forum/django-announcePermissions Required
• https://www.djangoproject.com/weblog/2024/jul/09/security-releases/Vendor Advisory
• https://docs.djangoproject.com/en/dev/releases/security/Vendor Advisory
• https://groups.google.com/forum/#%21forum/django-announcePermissions Required
• https://security.netapp.com/advisory/ntap-20240808-0005/
• https://www.djangoproject.com/weblog/2024/jul/09/security-releases/Vendor Advisory

Published

Jul 10, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-39325aimeos/ai-controller-frontend is the Aimeos frontend contro…5.3
• CVE-2024-39326SkillTree is a micro-learning gamification platform. Prior t…4.4
• CVE-2024-39327Incorrect Access Control vulnerability in Atos Eviden IDRA b…9.9
• CVE-2024-39328Insecure Permissions in Atos Eviden IDRA and IDCA before 2.7…6.8
• CVE-2024-39329An issue was discovered in Django 5.0 before 5.0.7 and 4.2 b…5.3
• CVE-2024-3933In Eclipse OpenJ9 release versions prior to 0.44.0 and after…7.3
• CVE-2024-39331In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el e…9.8
• CVE-2024-39332Webswing 23.2.2 allows remote attackers to modify client-sid…9.8
• CVE-2024-39334MENDELSON AS4 before 2024 B376 has a client-side vulnerabili…6.5
• CVE-2024-39335Supported versions of Mahara 24.04 before 24.04.1 and 23.04 …9.1
• CVE-2024-39337Click Studios Passwordstate Core before 9.8 build 9858 allow…6.5
• CVE-2024-39338axios 1.7.2 allows SSRF via unexpected behavior where reques…7.5