3 files changed, 32 insertions, 0 deletions
diff --git a/docs/releases/2.2.18.txt b/docs/releases/2.2.18.txt
new file mode 100644
index 0000000000..45df4fb83c
--- /dev/null
+++ b/docs/releases/2.2.18.txt
@@ -0,0 +1,15 @@
+===========================
+Django 2.2.18 release notes
+===========================
+
+*February 1, 2021*
+
+Django 2.2.18 fixes a security issue with severity "low" in 2.2.17.
+
+CVE-2021-3281: Potential directory-traversal via ``archive.extract()``
+======================================================================
+
+The ``django.utils.archive.extract()`` function, used by
+:option:`startapp --template` and :option:`startproject --template`, allowed
+directory-traversal via an archive with absolute paths or relative paths with
+dot segments.
diff --git a/docs/releases/3.0.12.txt b/docs/releases/3.0.12.txt
new file mode 100644
index 0000000000..20d9459fea
--- /dev/null
+++ b/docs/releases/3.0.12.txt
@@ -0,0 +1,15 @@
+===========================
+Django 3.0.12 release notes
+===========================
+
+*February 1, 2021*
+
+Django 3.0.12 fixes a security issue with severity "low" in 3.0.11.
+
+CVE-2021-3281: Potential directory-traversal via ``archive.extract()``
+======================================================================
+
+The ``django.utils.archive.extract()`` function, used by
+:option:`startapp --template` and :option:`startproject --template`, allowed
+directory-traversal via an archive with absolute paths or relative paths with
+dot segments.
diff --git a/docs/releases/index.txt b/docs/releases/index.txt
index b08af9fa51..49281fa9b5 100644
--- a/docs/releases/index.txt
+++ b/docs/releases/index.txt
@@ -25,6 +25,7 @@ versions of the documentation contain the release notes for any later releases.
 .. toctree::
    :maxdepth: 1
 
+   3.0.12
    3.0.11
    3.0.10
    3.0.9
@@ -43,6 +44,7 @@ versions of the documentation contain the release notes for any later releases.
 .. toctree::
    :maxdepth: 1
 
+   2.2.18
    2.2.17
    2.2.16
    2.2.15