CVE-2024-39330

What it actually does

Custom subclasses of django.core.files.storage.Storage that override generate_filename() without replicating the parent class file-path validations allow directory traversal via crafted inputs during save() calls; built-in subclasses are unaffected.

Why it matters to the business

Applications with custom storage backends risk unauthorized file reads or writes outside intended directories, potentially exposing sensitive data or enabling tampering. Urgency remains low given stable low EPSS, no KEV listing, and no known threat actor exploitation after 825 days.

How an attack unfolds

An attacker supplies a malicious filename containing traversal sequences to an application endpoint that triggers save() on a vulnerable custom Storage subclass; missing validations in the overridden generate_filename() permit the path to escape the intended directory.

How to fix it

Upgrade Django to 5.0.7 or 4.2.14 or later. On Debian 12 apply package version 6.1.94-1 or newer; on Debian 13 apply 6.8.11-1 or newer. Ensure any custom Storage subclasses replicate the parent's generate_filename() validations.

How to confirm the fix worked

Audit custom Storage classes to confirm generate_filename() includes the base-class path checks; attempt traversal payloads in test environments and verify files remain confined to the intended directory.

Typical attack path

1. Locate a Django application exposing file upload or save functionality that uses a custom Storage subclass overriding generate_filename()
2. Craft an input filename containing directory traversal sequences such as '../'
3. Submit the input to trigger a save() operation
4. Access or modify files outside the designated storage root

How to detect it

Search application and web-server logs for save() operations or file paths containing sequences such as '../' originating from user-controlled filename fields; no public exploitation artifacts are known.

What your security team should do

• Apply the listed Debian package updates immediately on affected systems
• Review and correct all custom Storage subclass implementations
• Add unit tests that exercise generate_filename() with traversal inputs
• Monitor file-system access logs for unexpected paths until patches are deployed