In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django's "Uploading multiple files" documentation suggested otherwise.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade satellite-maintainUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-foreman_maintainUpgrade rubygem-gssapiUpgrade rubygem-clampUpgrade rubygem-localeUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-oauthUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-version_gemUpgrade foreman-cliUpgrade rubygem-unf_extUpgrade rubygem-hammer_cliUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hashieUpgrade rubygem-netrcUpgrade rubygem-http-cookieUpgrade rubygem-unfUpgrade rubygem-oauth-ttyUpgrade rubygem-little-pluggerUpgrade rubygem-amazing_printUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-mime-types-dataUpgrade rubygem-ffi-debugsourceUpgrade rubygem-unicode-debuginfoUpgrade rubygem-loggingUpgrade rubygem-snaky_hashUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_openscapUpgrade satellite-cloneUpgrade rubygem-powerbarUpgrade rubygem-ffi-debuginfoUpgrade rubygem-apipie-bindingsUpgrade rubygem-multi_jsonUpgrade rubygem-mime-typesUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-ffiUpgrade rubygem-fast_gettextUpgrade rubygem-domain_nameUpgrade satellite-cliUpgrade rubygem-unicode-debugsourceUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cli_foreman_virt_who_configure | Nov 1, 2023 | May 7, 2023 |
| Debian | — | Upgrade python-django | May 8, 2023 | May 7, 2023 |
| Freebsd | — | Upgrade py311-django41Upgrade py310-django42Upgrade py37-django32Upgrade py39-django32Upgrade py39-django41Upgrade py311-django32Upgrade py310-django32Upgrade py38-django41Upgrade py38-django32Upgrade py39-django42Upgrade py38-django42Upgrade py310-django41Upgrade py311-django42 | Dec 10, 2025 | May 5, 2023 |
| Redhat_linux | — | Upgrade rubygem-unicode-debuginfoUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-ffi-debugsourceUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-http-cookieUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-highlineUpgrade rubygem-loggingUpgrade rubygem-unicodeUpgrade rubygem-snaky_hashUpgrade rubygem-hammer_cli_katelloUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cliUpgrade rubygem-apipie-bindingsUpgrade rubygem-http-acceptUpgrade rubygem-unf_extUpgrade rubygem-version_gemUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-gssapiUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-fast_gettextUpgrade rubygem-ffi-debuginfoUpgrade rubygem-oauthUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade foreman-cliUpgrade rubygem-amazing_printUpgrade satellite-cloneUpgrade rubygem-rest-clientUpgrade satellite-maintainUpgrade rubygem-ffiUpgrade rubygem-unfUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-powerbarUpgrade rubygem-multi_jsonUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-little-pluggerUpgrade rubygem-oauth-ttyUpgrade satellite-cliUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-unicode-display_width | Nov 1, 2023 | May 7, 2023 |
| Rocky_linux | — | Upgrade libdb-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-cxxUpgrade libdb-sql-devel-debuginfoUpgrade libdb-debugsourceUpgrade libdb-cxx-debuginfo | Mar 5, 2024 | May 7, 2023 |
| Suse | — | Upgrade python3-django | Jul 17, 2023 | May 7, 2023 |
| Ubuntu | — | Upgrade python-django (Ubuntu Pro)Upgrade python3-django (Ubuntu Pro)Upgrade python-djangoUpgrade python3-djangoUpgrade python-django-doc (Ubuntu Pro) | May 4, 2023 | May 3, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub