---
id: CVE-2013-1665
aliases:
  - GHSA-x64m-686f-fmm3
  - PYSEC-2026-802
title: XML External Entity (XXE) in Django
summary: XML External Entity (XXE) in Django
severity: medium
vendor: django
product: django
ecosystem: pip
affected:
  - 'django >= 1.3.0, < 1.3.6'
  - 'django >= 1.4.0, < 1.4.4'
patched:
  - django 1.3.6
  - django 1.4.4
published: '2022-05-17'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-x64m-686f-fmm3'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2013-1665'
  - url: >-
      https://github.com/django/django/commit/1c60d07ba23e0350351c278ad28d0bd5aa410b40
  - url: >-
      https://github.com/django/django/commit/d19a27066b2247102e65412aa66917aff0091112
  - url: 'https://bugs.launchpad.net/keystone/+bug/1100279'
  - url: 'http://blog.python.org/2013/02/announcing-defusedxml-fixes-for-xml.html'
  - url: 'http://bugs.python.org/issue17239'
  - url: >-
      http://lists.openstack.org/pipermail/openstack-announce/2013-February/000078.html
  - url: 'http://rhn.redhat.com/errata/RHSA-2013-0657.html'
  - url: 'http://rhn.redhat.com/errata/RHSA-2013-0658.html'
  - url: 'http://rhn.redhat.com/errata/RHSA-2013-0670.html'
  - url: 'http://ubuntu.com/usn/usn-1757-1'
  - url: 'http://www.debian.org/security/2013/dsa-2634'
  - url: 'http://www.openwall.com/lists/oss-security/2013/02/19/2'
  - url: 'http://www.openwall.com/lists/oss-security/2013/02/19/4'
tags:
  - osv
  - pip
epss: 0.04631
epssPercentile: 0.91294
ingestedAt: '2026-07-08T18:25:54.121Z'
---

## Overview

The XML libraries for Python as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) attack.

## Affected packages

- `django >= 1.3.0, < 1.3.6`
- `django >= 1.4.0, < 1.4.4`

## Remediation

Upgrade to a patched release:

- `django 1.3.6`
- `django 1.4.4`