Context Navigation

Changes between Version 34 and Version 35 of SecurityTeam

-              v34
+              v35
 Kind regards, The Django Security Team.
+=== Symlink traversal and symlink-following within trusted storage locations ===
+Hello,
+Thank you for your report.
+After review, we do not consider this a security vulnerability.
+Django assumes configured storage locations and their contents are trusted. Symlinks within those locations are a valid deployment configuration and may legitimately be used by system administrators, so Django intentionally supports following them. The scenarios you describe require an attacker to already be able to create or modify filesystem objects within that storage. Because this falls outside Django's assumptions about configured storage locations, we do not consider this a security issue.
+Thanks for taking the time to submit it through the appropriate channel.
+Kind regards, the Django Security Team.
 === Unauthenticated cache purge/Pickle deserialization ===