—

PYSEC-2023-210

Quick fix

PYSEC-2023-210 — coderedcms: upgrade to the fixed version with the command below.

pip install --upgrade 'coderedcms>=0.22.3'

Details

views.py in Wagtail CRX CodeRed Extensions (formerly CodeRed CMS or coderedcms) before 0.22.3 allows upward protected/..%2f..%2f path traversal when serving protected media.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/coderedcms

Introduced in: 0Fixed in: 0.22.3

Fixpip install --upgrade 'coderedcms>=0.22.3'

References

https://github.com/coderedcorp/coderedcms/issues/448[REPORT]
https://github.com/coderedcorp/coderedcms/pull/450[WEB]
https://github.com/coderedcorp/coderedcms/compare/v0.22.2...v0.22.3[WEB]
https://github.com/advisories/GHSA-h454-rq3m-89rc[ADVISORY]