In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django's "Uploading multiple files" documentation suggested otherwise.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-hammer_cliUpgrade rubygem-highlineUpgrade rubygem-unicode-display_widthUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-gssapiUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-netrcUpgrade rubygem-oauthUpgrade foreman-cliUpgrade rubygem-unf_extUpgrade rubygem-rest-clientUpgrade rubygem-clampUpgrade rubygem-localeUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foremanUpgrade satellite-maintainUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-version_gemUpgrade rubygem-amazing_printUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-ffiUpgrade rubygem-fast_gettextUpgrade rubygem-domain_nameUpgrade satellite-cliUpgrade rubygem-unfUpgrade rubygem-snaky_hashUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-unicodeUpgrade rubygem-powerbarUpgrade rubygem-ffi-debuginfoUpgrade rubygem-apipie-bindingsUpgrade rubygem-mime-types-dataUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-http-acceptUpgrade rubygem-unicode-debuginfoUpgrade rubygem-loggingUpgrade rubygem-little-pluggerUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade satellite-cloneUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-multi_jsonUpgrade rubygem-mime-typesUpgrade rubygem-oauth-ttyUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_ansible | Nov 1, 2023 | May 7, 2023 |
| Debian | — | Upgrade python-django | May 8, 2023 | May 7, 2023 |
| Freebsd | — | Upgrade py311-django42Upgrade py310-django41Upgrade py38-django42Upgrade py38-django41Upgrade py311-django32Upgrade py38-django32Upgrade py311-django41Upgrade py310-django32Upgrade py39-django41Upgrade py39-django32Upgrade py310-django42Upgrade py39-django42Upgrade py37-django32 | Dec 10, 2025 | May 5, 2023 |
| Redhat_linux | — | Upgrade rubygem-http-cookieUpgrade rubygem-unicode-debuginfoUpgrade rubygem-unicode-debugsourceUpgrade rubygem-http-acceptUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-ffi-debugsourceUpgrade rubygem-unicodeUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-clampUpgrade rubygem-oauthUpgrade rubygem-localeUpgrade rubygem-domain_nameUpgrade rubygem-ffi-debuginfoUpgrade rubygem-rest-clientUpgrade foreman-cliUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_googleUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-gssapiUpgrade rubygem-snaky_hashUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-version_gemUpgrade rubygem-apipie-bindingsUpgrade rubygem-highlineUpgrade rubygem-fast_gettextUpgrade rubygem-loggingUpgrade rubygem-mime-types-dataUpgrade rubygem-ffiUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-oauth-ttyUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-mime-typesUpgrade satellite-maintainUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unf_ext-debugsourceUpgrade satellite-cliUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-unfUpgrade rubygem-netrcUpgrade rubygem-powerbar | Nov 1, 2023 | May 7, 2023 |
| Rocky_linux | — | Upgrade libdb-sql-debuginfoUpgrade libdb-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-cxxUpgrade libdb-cxx-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-debugsource | Mar 5, 2024 | May 7, 2023 |
| Suse | — | Upgrade python3-django | Jul 17, 2023 | May 7, 2023 |
| Ubuntu | — | Upgrade python3-django (Ubuntu Pro)Upgrade python-django (Ubuntu Pro)Upgrade python-djangoUpgrade python-django-doc (Ubuntu Pro)Upgrade python3-django | May 4, 2023 | May 3, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub