A partial directory traversal vulnerability exists in Django versions 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The issue is in the django.utils.archive.extract() function, which is used by the 'startapp --template' and 'startproject --template' commands. This allows crafted archives with file paths sharing a common prefix with the target directory to perform partial directory traversal.