In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django's "Uploading multiple files" documentation suggested otherwise.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-gssapiUpgrade python39-pulp_manifestUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-foreman_maintainUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-version_gemUpgrade rubygem-localeUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cliUpgrade rubygem-netrcUpgrade rubygem-oauthUpgrade foreman-cliUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-unf_extUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-highlineUpgrade rubygem-http-acceptUpgrade rubygem-unicode-debugsourceUpgrade rubygem-unicodeUpgrade rubygem-powerbarUpgrade rubygem-jwtUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-amazing_printUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-mime-types-dataUpgrade rubygem-apipie-bindingsUpgrade rubygem-oauth-ttyUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-ffiUpgrade rubygem-fast_gettextUpgrade rubygem-domain_nameUpgrade satellite-cliUpgrade rubygem-unfUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-unicode-debuginfoUpgrade rubygem-loggingUpgrade rubygem-little-pluggerUpgrade rubygem-ffi-debugsourceUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-ffi-debuginfoUpgrade rubygem-snaky_hashUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-mime-types | Nov 1, 2023 | May 7, 2023 |
| Debian | — | Upgrade python-django | May 8, 2023 | May 7, 2023 |
| Freebsd | — | Upgrade py311-django42Upgrade py38-django42Upgrade py310-django41Upgrade py39-django42Upgrade py311-django32Upgrade py38-django41Upgrade py311-django41Upgrade py310-django32Upgrade py37-django32Upgrade py39-django32Upgrade py39-django41Upgrade py38-django32Upgrade py310-django42 | Dec 10, 2025 | May 5, 2023 |
| Redhat_linux | — | Upgrade rubygem-jwtUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-http-cookieUpgrade rubygem-ffi-debuginfoUpgrade foreman-cliUpgrade rubygem-oauthUpgrade rubygem-unicode-debugsourceUpgrade rubygem-unf_extUpgrade rubygem-localeUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cliUpgrade rubygem-snaky_hashUpgrade rubygem-clampUpgrade rubygem-apipie-bindingsUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-amazing_printUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-rest-clientUpgrade python39-pulp_manifestUpgrade rubygem-domain_nameUpgrade rubygem-highlineUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-unicodeUpgrade rubygem-version_gemUpgrade rubygem-gssapiUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-netrcUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-unfUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-foreman_maintainUpgrade satellite-maintainUpgrade rubygem-powerbarUpgrade rubygem-oauth-ttyUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_tasksUpgrade satellite-cliUpgrade rubygem-little-pluggerUpgrade rubygem-mime-types-dataUpgrade rubygem-hashieUpgrade rubygem-ffi | Nov 1, 2023 | May 7, 2023 |
| Rocky_linux | — | Upgrade libdb-cxx-debuginfoUpgrade libdb-debugsourceUpgrade libdb-sql-devel-debuginfoUpgrade libdb-cxxUpgrade libdb-sql-debuginfoUpgrade libdb-debuginfoUpgrade libdb-utils-debuginfo | Mar 5, 2024 | May 7, 2023 |
| Suse | — | Upgrade python3-django | Jul 17, 2023 | May 7, 2023 |
| Ubuntu | — | Upgrade python3-django (Ubuntu Pro)Upgrade python-django (Ubuntu Pro)Upgrade python-djangoUpgrade python-django-doc (Ubuntu Pro)Upgrade python3-django | May 4, 2023 | May 3, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub