{"id":"CVE-2021-46897","aliases":["GHSA-h454-rq3m-89rc","PYSEC-2023-210"],"url":"https://o3.security/vulnerability/CVE-2021-46897","summary":"Wagtail CRX CodeRed Extensions vulnerable to Path Traversal","details":"views.py in Wagtail CRX CodeRed Extensions (formerly CodeRed CMS or coderedcms) before 0.22.3 allows upward protected/..%2f..%2f path traversal when serving protected media.","published":"2023-10-22T19:15:08.240Z","modified":"2026-07-09T05:13:20.791503Z","cvss":{"score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"PyPI","name":"coderedcms","fixedVersion":"0.22.3"}],"fix":{"url":"https://github.com/coderedcorp/coderedcms/pull/450","label":"coderedcorp/coderedcms#450"},"references":[{"type":"ADVISORY","url":"https://github.com/coderedcorp/coderedcms/pull/450"},{"type":"REPORT","url":"https://github.com/coderedcorp/coderedcms/issues/448"},{"type":"FIX","url":"https://github.com/coderedcorp/coderedcms/compare/v0.22.2...v0.22.3"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-09T05:13:20.791503Z"}}