GitHub Advisoryadvisory · PyPI

GHSA-j4v3-wwwx-5gqv Django Filer Unrestricted Upload of File with Dangerous Type

MEDIUM Published 2024-11-20 Modified 2026-06-09 Official page ↗
Aliases
CVE-2024-11404
Ecosystem
PyPI
Packages
django-filer
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Weaknesses
CWE-20, CWE-434, CWE-80
Reviewed
2024-11-20

Affected packages

• PyPI django-filer: < 3.3.0 → fixed in 3.3.0

Description

Unrestricted Upload of File with Dangerous Type, Improper Input Validation, Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in django CMS Association django Filer allows Input Data Manipulation, Stored XSS.This issue affects django Filer: from 3 before 3.3.

Related

Alias · CVE (1)

  • CVE-2024-11404 Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)… vulnerability

Weakness · CWE (3)

  • CWE-20 Improper Input Validation weakness
  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness
  • CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page weakness

References