{"action":"Upgrade coderedcms to 0.22.3 or later.","affected":[{"fixed":"0.22.3","introduced":"0"}],"component":"coderedcms","cve_ids":["CVE-2021-46897"],"ecosystem":"PyPI","epss":0.00891,"exploited":false,"fixed_versions":["0.22.3"],"ghsa_id":"GHSA-h454-rq3m-89rc","id":"tcs_01M5KGJX59521XCNNP1QZPPNDG","modified_at":"2026-06-10T17:00:44.948141031Z","published_at":"2023-10-22T19:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2023-210","https://github.com/coderedcorp/coderedcms/issues/448","https://github.com/coderedcorp/coderedcms/pull/450","https://github.com/coderedcorp/coderedcms/compare/v0.22.2...v0.22.3","https://github.com/advisories/GHSA-h454-rq3m-89rc"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2023-210","url":"https://osv.dev/vulnerability/PYSEC-2023-210"}],"summary":"views.py in Wagtail CRX CodeRed Extensions (formerly CodeRed CMS or coderedcms) before 0.22.3 allows upward protected/..%2f..%2f path traversal when serving protected media."}