{"action":"Upgrade django to 2.2.26 or later.","affected":[{"fixed":"2.2.26","introduced":"2.2"},{"fixed":"3.2.11","introduced":"3.2"},{"fixed":"4.0.1","introduced":"4.0"}],"component":"django","cve_ids":["CVE-2021-45452"],"ecosystem":"PyPI","epss":0.02408,"exploited":false,"fixed_versions":["2.2.26","3.2.11","4.0.1"],"ghsa_id":"GHSA-jrh2-hc4r-7jwx","id":"tcs_01M5KGH2QVXP71MN02ASCZJ26S","modified_at":"2023-12-06T01:01:43.819827Z","published_at":"2022-01-05T00:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2022-3","https://docs.djangoproject.com/en/4.0/releases/security/","https://groups.google.com/forum/#!forum/django-announce","https://www.djangoproject.com/weblog/2022/jan/04/security-releases/","https://github.com/advisories/GHSA-jrh2-hc4r-7jwx"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2022-3","url":"https://osv.dev/vulnerability/PYSEC-2022-3"}],"summary":"Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it."}