CVE-2021-3281

22

FAUCET Score

CVE-2021-3281 is a directory traversal vulnerability affecting Django versions 2.2.x, 3.0.x, and 3.1.x, specifically within the django.utils.archive.extract method used by template commands. This flaw allows an attacker to write arbitrary files to unexpected locations by crafting malicious archives containing absolute or dot-segment paths. Rated as Medium severity (CVSS 5.3), it has a low attack complexity and no user interaction required, but its impact is limited to integrity. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 2.2, < 2.2.18CPE matchmatch criteria	cpe:2.3:a:djangoproject:django::::::::
		>= 3.0, < 3.0.12CPE matchmatch criteria	cpe:2.3:a:djangoproject:django::::::::
		>= 3.1, < 3.1.6CPE matchmatch criteria	cpe:2.3:a:djangoproject:django::::::::
		33CPE matchmatch criteria	cpe:2.3:o:fedoraproject:fedora:33:::::::*
		Range not provided by sourceCPE matchmatch criteria	cpe:2.3:a:netapp:snapcenter:-:::::::*

CVSS Data

CVSS version used by this source: 3.1

5.3MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

Exploitability Score

3.9

Impact Score

1.4

CvssVersion

3.1

Exploit Intelligence

EPSS Score

7.61%

Probability of exploitation in next 30 days

EPSS Percentile

93.9%

Percentile rank of EPSS score among Peer Group

As of 2026-07-28

Model: v2026.06.15

This CVE's current EPSS score of 0.0761 is in the 92nd percentile among its peer group of 23,725 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (27)

pippatch availablevia ghsa

Product: djangoFixed in: 3.0.12

pippatch availablevia ghsa

Product: djangoFixed in: 2.2.18

pippatch availablevia ghsa

Product: djangoFixed in: 3.1.6

redhatpatch availablevia redhat_api

Product: Red Hat Automation Hub 4.2 for RHEL 7Fixed in: automation-hub-0:4.2.2-1.el7pc

redhatpatch availablevia redhat_api

Product: Red Hat Automation Hub 4.2 for RHEL 7Fixed in: python3-django-0:2.2.18-1.el7pc

redhatpatch availablevia redhat_api

Product: Red Hat Automation Hub 4.2 for RHEL 7Fixed in: python-bleach-0:3.3.0-1.el7pc

redhatpatch availablevia redhat_api

Product: Red Hat Automation Hub 4.2 for RHEL 7Fixed in: python-bleach-allowlist-0:1.0.3-1.el7pc

redhatpatch availablevia redhat_api

Product: Red Hat Automation Hub 4.2 for RHEL 7Fixed in: python-galaxy-importer-0:0.2.15-1.el7pc

redhatpatch availablevia redhat_api

Product: Red Hat Automation Hub 4.2 for RHEL 7Fixed in: python-galaxy-ng-0:4.2.2-1.el7pc

redhatpatch availablevia redhat_api

Product: Red Hat Automation Hub 4.2 for RHEL 7Fixed in: python-pulp-ansible-1:0.5.6-1.el7pc

redhatpatch availablevia redhat_api

Product: Red Hat Automation Hub 4.2 for RHEL 8Fixed in: automation-hub-0:4.2.2-1.el8pc

redhatpatch availablevia redhat_api

Product: Red Hat Automation Hub 4.2 for RHEL 8Fixed in: python-bleach-0:3.3.0-1.el8pc

redhatpatch availablevia redhat_api

Product: Red Hat Automation Hub 4.2 for RHEL 8Fixed in: python-bleach-allowlist-0:1.0.3-1.el8pc

redhatpatch availablevia redhat_api

Product: Red Hat Automation Hub 4.2 for RHEL 8Fixed in: python-galaxy-importer-0:0.2.15-1.el8pc

redhatpatch availablevia redhat_api

Product: Red Hat Automation Hub 4.2 for RHEL 8Fixed in: python-galaxy-ng-0:4.2.2-1.el8pc

redhatpatch availablevia redhat_api

Product: Red Hat Automation Hub 4.2 for RHEL 8Fixed in: python-pulp-ansible-1:0.5.6-1.el8pc

redhatpatch availablevia redhat_api

Product: Red Hat OpenStack Platform 16.1Fixed in: python-django20-0:2.0.13-16.el8ost.1

redhatpatch availablevia redhat_api

Product: Red Hat OpenStack Platform 16.2Fixed in: python-django20-0:2.0.13-16.el8ost.1

redhatpatch availablevia redhat_api

Product: Red Hat Automation Hub 4.2 for RHEL 8Fixed in: python3-django-0:2.2.18-1.el8pc

redhatpatch availablevia redhat_api

Product: Red Hat Ansible Tower 3.8 for RHEL 7Fixed in: ansible-tower-38/ansible-runner-rhel7:1.4.7-1

redhatpatch availablevia redhat_api

Product: Red Hat Ansible Tower 3.8 for RHEL 7Fixed in: ansible-tower-38/ansible-tower-rhel7:3.8.2-1

redhatvendor investigatingvia redhat_api

Product: Red Hat Storage 3Fixed in: python-django

redhatvendor investigatingvia redhat_api

Product: Red Hat Update Infrastructure 3 for Cloud ProvidersFixed in: python-django

redhatno patchvia redhat_api

Product: Red Hat Ansible Automation Platform 1.2Fixed in: python-django

redhatno patchvia redhat_api

Product: Red Hat Satellite 6Fixed in: python-django

redhatend of lifevia redhat_api

Product: Red Hat Ceph Storage 3Fixed in: python-django

redhatend of lifevia redhat_api

Product: Red Hat OpenStack Platform 13 (Queens)Fixed in: python-django

Vendor Advisories (2)

pipGHSA-fvgf-6h6h-3322medium

Django Directory Traversal via archive.extract

redhatCVE-2021-3281Moderate

django: Potential directory-traversal via archive.extract()

References

docs.djangoproject.com / en/3.1/releases/security

PatchVendor Advisory

groups.google.com / forum

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/YF52FKEH5S2P5CM4X7IXSYG67YY2CDOO

security.netapp.com / advisory/ntap-20210226-0004

Third Party Advisory

djangoproject.com / weblog/2021/feb/01/security-releases

Vendor Advisory