From 74fa85c688a87224637155902bcd738bb9e65e11 Mon Sep 17 00:00:00 2001
From: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
Date: Tue, 16 Sep 2025 17:13:36 +0200
Subject: [5.1.x] Fixed CVE-2025-59682 -- Fixed potential partial
 directory-traversal via archive.extract().

Thanks stackered for the report.

Follow up to 05413afa8c18cdb978fcdf470e09f7a12b234a23.

Backport of 924a0c092e65fa2d0953fd1855d2dc8786d94de2 from main.
---
 docs/releases/4.2.25.txt | 8 ++++++++
 1 file changed, 8 insertions(+)

(limited to 'docs/releases/4.2.25.txt')

diff --git a/docs/releases/4.2.25.txt b/docs/releases/4.2.25.txt
index 5412777055..7ba23c0132 100644
--- a/docs/releases/4.2.25.txt
+++ b/docs/releases/4.2.25.txt
@@ -15,3 +15,11 @@ CVE-2025-59681: Potential SQL injection in ``QuerySet.annotate()``, ``alias()``,
 to SQL injection in column aliases, using a suitably crafted dictionary, with
 dictionary expansion, as the ``**kwargs`` passed to these methods (follow up to
 :cve:`2022-28346`).
+
+CVE-2025-59682: Potential partial directory-traversal via ``archive.extract()``
+===============================================================================
+
+The ``django.utils.archive.extract()`` function, used by
+:option:`startapp --template` and :option:`startproject --template`, allowed
+partial directory-traversal via an archive with file paths sharing a common
+prefix with the target directory (follow up to :cve:`2021-3281`).
-- 
cgit v1.3