CVE-2021-3281

mediumpriority · track · 34EPSS 0.076 · 95 %ileexploit · PoCDEEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

7.61% (95th) EPSS

CVSS 5 · medium

Is it mine?

63 products

Check your exposure

Who says so?

7 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-23

In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedansible-tower-38/ansible-runner-rhel7@sha256:6208e426e90515de013194566833baad60f41df1052f25f45e55e8c0341ec62a_amd64 as a component of Red Hat Ansible Tower 3.8 for RHEL 7redhat_csaf
For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html
https://access.redhat.com/errata/RHSA-2021:0780
Fixedansible-tower-38/ansible-tower-rhel7@sha256:75e3ded9918cd3485fdd0e5b78006b08d9453eec304dfc5c635e5638bb77b0de_amd64 as a component of Red Hat Ansible Tower 3.8 for RHEL 7redhat_csaf
For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html
https://access.redhat.com/errata/RHSA-2021:0780
Fixedautomation-hub-0:4.2.2-1.el7pc.noarch as a component of Red Hat Automation Hub 4.2 for RHEL 7redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:0781
Fixedautomation-hub-0:4.2.2-1.el7pc.src as a component of Red Hat Automation Hub 4.2 for RHEL 7redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:0781
Fixedautomation-hub-0:4.2.2-1.el8pc.noarch as a component of Red Hat Automation Hub 4.2 for RHEL 8redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:0781
Fixedautomation-hub-0:4.2.2-1.el8pc.src as a component of Red Hat Automation Hub 4.2 for RHEL 8redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:0781
Fixedpython-bleach-0:3.3.0-1.el7pc.src as a component of Red Hat Automation Hub 4.2 for RHEL 7redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:0781
Fixedpython-bleach-0:3.3.0-1.el8pc.src as a component of Red Hat Automation Hub 4.2 for RHEL 8redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:0781
Fixedpython-bleach-allowlist-0:1.0.3-1.el7pc.src as a component of Red Hat Automation Hub 4.2 for RHEL 7redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:0781
Fixedpython-bleach-allowlist-0:1.0.3-1.el8pc.src as a component of Red Hat Automation Hub 4.2 for RHEL 8redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:0781
Fixedpython-galaxy-importer-0:0.2.15-1.el7pc.src as a component of Red Hat Automation Hub 4.2 for RHEL 7redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:0781
Fixedpython-galaxy-importer-0:0.2.15-1.el8pc.src as a component of Red Hat Automation Hub 4.2 for RHEL 8redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:0781
Fixedpython-galaxy-ng-0:4.2.2-1.el7pc.src as a component of Red Hat Automation Hub 4.2 for RHEL 7redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:0781
Fixedpython-galaxy-ng-0:4.2.2-1.el8pc.src as a component of Red Hat Automation Hub 4.2 for RHEL 8redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:0781
Fixedpython-pulp-ansible-1:0.5.6-1.el7pc.src as a component of Red Hat Automation Hub 4.2 for RHEL 7redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:0781
Fixedpython-pulp-ansible-1:0.5.6-1.el8pc.src as a component of Red Hat Automation Hub 4.2 for RHEL 8redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:0781
Fixedpython3-bleach-0:3.3.0-1.el7pc.noarch as a component of Red Hat Automation Hub 4.2 for RHEL 7redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:0781
Fixedpython3-bleach-0:3.3.0-1.el8pc.noarch as a component of Red Hat Automation Hub 4.2 for RHEL 8redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:0781
Fixedpython3-bleach-allowlist-0:1.0.3-1.el7pc.noarch as a component of Red Hat Automation Hub 4.2 for RHEL 7redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:0781
Fixedpython3-bleach-allowlist-0:1.0.3-1.el8pc.noarch as a component of Red Hat Automation Hub 4.2 for RHEL 8redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:0781
Fixedpython3-django-0:2.2.18-1.el7pc.noarch as a component of Red Hat Automation Hub 4.2 for RHEL 7redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:0781
Fixedpython3-django-0:2.2.18-1.el8pc.noarch as a component of Red Hat Automation Hub 4.2 for RHEL 8redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:0781
Fixedpython3-galaxy-importer-0:0.2.15-1.el7pc.noarch as a component of Red Hat Automation Hub 4.2 for RHEL 7redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:0781
Fixedpython3-galaxy-importer-0:0.2.15-1.el8pc.noarch as a component of Red Hat Automation Hub 4.2 for RHEL 8redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:0781
Fixedpython3-galaxy-ng-0:4.2.2-1.el7pc.noarch as a component of Red Hat Automation Hub 4.2 for RHEL 7redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:0781
Fixedpython3-galaxy-ng-0:4.2.2-1.el8pc.noarch as a component of Red Hat Automation Hub 4.2 for RHEL 8redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:0781
Fixedpython3-pulp-ansible-1:0.5.6-1.el7pc.noarch as a component of Red Hat Automation Hub 4.2 for RHEL 7redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:0781
Fixedpython3-pulp-ansible-1:0.5.6-1.el8pc.noarch as a component of Red Hat Automation Hub 4.2 for RHEL 8redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:0781
Fixedpython-django20-0:2.0.13-16.el8ost.1.src as a component of Red Hat OpenStack Platform 16.2redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:3490
Fixedpython3-django20-0:2.0.13-16.el8ost.1.noarch as a component of Red Hat OpenStack Platform 16.2redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:3490
Fixedpython-django20-0:2.0.13-16.el8ost.1.src as a component of Red Hat OpenStack Platform 16.1redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:5070
Fixedpython-django20-bash-completion-0:2.0.13-16.el8ost.1.noarch as a component of Red Hat OpenStack Platform 16.1redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:5070
Fixedpython3-django20-0:2.0.13-16.el8ost.1.noarch as a component of Red Hat OpenStack Platform 16.1redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:5070

cvss

Technical severity, 0–10. One row per scoring source.

5.3

010

base score 0–10 · higher = more severe · hover a vector to decode

v2.05mediumAV:N/AC:L/Au:N/C:N/I:P/A:Nprimary · NVD / NIST USexploitability 10 · impact 2.9

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 1.4

v3.15.3mediumAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · FSTEC (BDU) RU

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · OSV

v3.15mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:Psecondary · CVSS-BT (t0sche)

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · Red Hat Product Security US

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-22USprimaryCWE-22USCWE-22USCWE-22US

exploits (1)

Public proof-of-concept and weaponised exploit code.

lwzSoviet/CVE-2021-3281lwzSoviet/CVE-2021-3281PoC · poc_in_github

affected products (63)

Products and version ranges known to be affected.

Amazon Linux 2all versionscert_bundDEcpe:/o:amazon:linux_2:-
Debian Linuxall versionscert_bundDEcpe:/o:debian:debian_linux:-
Open Source Ansible Tower 3.8all versionscert_bundDEcpe:/a:open_source:ansible_tower:3.8.0
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
SUSE Linuxall versionscert_bundDEcpe:/o:suse:suse_linux:-
SUSE openSUSEall versionscert_bundDEcpe:/o:suse:opensuse:-
n/a n/a≤ n/aenisa_euvdEU
Django Software Foundation Django2.2 → 2.2.18fstec_bduRU
Django Software Foundation Django3.0 → 3.0.12fstec_bduRU
Django Software Foundation Django3.1 → 3.1.6fstec_bduRU
АО «НППКТ» ОСОН ОСнова Оnyx≤ 2.5fstec_bduRU
ООО «РусБИТех-Астра» Astra Linux Common Edition≤ 2.12 «Орёл»fstec_bduRU
ООО «РусБИТех-Астра» Astra Linux Special Edition≤ 1.7fstec_bduRU
ООО «РусБИТех-Астра» Astra Linux Special Edition≤ 4.7fstec_bduRU
ООО «РусБИТех-Астра» Astra Linux Special Edition≤ 1.6 «Смоленск»fstec_bduRU
ООО «РусБИТех-Астра» Astra Linux Special Edition для «Эльбрус»≤ 8.1 «Ленинград»fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 8fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 10fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 9fstec_bduRU
djangoproject django2.2 → 2.2.18nvdUScpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*

showing 20 of 63

advisories (8)

Vendor and ecosystem advisories describing this.

RHSA-2021:0780Red Hat Security Advisory: Red Hat Ansible Tower 3.8.2-1 - Container security and bug fix update2021-03-09csaf · redhat_csafUS
Red Hat Ansible Tower 3.8.2-1 - Container Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
RHSA-2021:0781Red Hat Security Advisory: Red Hat Ansible Automation Platform 1.2.2 security and bug fix update2021-03-09csaf · redhat_csafUS
An update is now available for Red Hat Ansible Automation Platform 1.2.2. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
RHSA-2021:3490Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 (python-django20) security update2021-09-15csaf · redhat_csafUS
An update for python-django20 is now available for Red Hat OpenStack Platform 16.2 (Train). Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
RHSA-2021:5070Red Hat Security Advisory: Red Hat OpenStack Platform 16.1 (python-django20) security update2021-12-09csaf · redhat_csafUS
An update for python-django20 is now available for Red Hat OpenStack Platform 16.1 (Train). Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
WID-SEC-W-2022-1352Ansible Tower: Mehrere SchwachstellenDeutsch2021-03-09csaf · cert_bundDE
Ein lokaler oder entfernter Angreifer kann mehrere Schwachstellen in Ansible Tower ausnutzen, um Informationen offenzulegen oder seine Privilegien zu erweitern.
GHSA-fvgf-6h6h-3322Django Directory Traversal via archive.extract2021-03-18ghsa · osvUS
In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments.
BIT-django-2021-32812024-03-06vendor · osvUS
In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments.
PYSEC-2021-92021-02-02vendor · osvUS
In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments.

also known as (8)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund nvd redhat_csaf NVD CVE.org MITRE

published 2021-02-02modified 2026-06-17

related (12,474)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-104286US	—OT critical	2.20% (82nd)	KEV	2026-10-01
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail…
CVE-2026-93616US	—OT critical	75.9% (100th)	KEV	2026-09-22
A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.
CVE-2026-85706US	—OT critical	92.0% (100th)	KEV	2026-09-12
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2…
CVE-2026-66384US	—OT critical	0.66% (51st)	KEV	2026-08-12
An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.
CVE-2026-59310US	—OT critical	2.56% (85th)	KEV	2026-07-30
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.

+12469 more

references (29)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan