GitHub Advisoryadvisory · PyPI

GHSA-r3xc-prgr-mg9p Django bypasses validation when using one form field to upload multiple files

CRITICAL Published 2023-05-07 Modified 2024-09-20 Official page ↗
Aliases
CVE-2023-31047
Ecosystem
PyPI
Packages
Django
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20
Reviewed
2023-05-09

Affected packages

• PyPI Django: >= 3.2a1, < 3.2.19 → fixed in 3.2.19 • PyPI Django: >= 4.0a1, < 4.1.9 → fixed in 4.1.9 • PyPI Django: >= 4.2a1, < 4.2.1 → fixed in 4.2.1

Description

In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django's "Uploading multiple files" documentation suggested otherwise.

Related

Alias · CVE (1)

  • CVE-2023-31047 In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References