{"action":"Upgrade django to 2.2.18 or later.","affected":[{"fixed":"2.2.18","introduced":"2.2"},{"fixed":"3.0.12","introduced":"3.0"},{"fixed":"3.1.6","introduced":"3.1"}],"component":"django","cve_ids":["CVE-2021-3281"],"ecosystem":"PyPI","epss":0.07605,"exploited":false,"fixed_versions":["2.2.18","3.0.12","3.1.6"],"ghsa_id":"GHSA-fvgf-6h6h-3322","id":"tcs_01M5KGFTNS015HM3S5K5QTF41G","modified_at":"2023-12-06T01:01:15.916389Z","published_at":"2021-02-02T07:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2021-9","https://docs.djangoproject.com/en/3.1/releases/security/","https://www.djangoproject.com/weblog/2021/feb/01/security-releases/","https://groups.google.com/forum/#!forum/django-announce","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YF52FKEH5S2P5CM4X7IXSYG67YY2CDOO/","https://security.netapp.com/advisory/ntap-20210226-0004/","https://github.com/advisories/GHSA-fvgf-6h6h-3322"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2021-9","url":"https://osv.dev/vulnerability/PYSEC-2021-9"}],"summary":"In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by \"startapp --template\" and \"startproject --template\") allows directory traversal v"}