In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django's "Uploading multiple files" documentation suggested otherwise.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade python39-pulp_manifestUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-version_gemUpgrade rubygem-netrcUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_tasksUpgrade satellite-maintainUpgrade rubygem-hashieUpgrade rubygem-unf_extUpgrade rubygem-rest-clientUpgrade rubygem-oauthUpgrade foreman-cliUpgrade rubygem-hammer_cliUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-foreman_maintainUpgrade rubygem-gssapiUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-ffi-debuginfoUpgrade rubygem-unicode-debugsourceUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-mime-types-dataUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-unicode-debuginfoUpgrade rubygem-loggingUpgrade rubygem-little-pluggerUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-multi_jsonUpgrade rubygem-mime-typesUpgrade rubygem-jwtUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-snaky_hashUpgrade rubygem-amazing_printUpgrade rubygem-ffiUpgrade rubygem-unfUpgrade rubygem-oauth-ttyUpgrade satellite-cloneUpgrade rubygem-powerbarUpgrade rubygem-http-cookieUpgrade rubygem-http-acceptUpgrade satellite-cliUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-fast_gettext | Nov 1, 2023 | May 7, 2023 |
| Debian | — | Upgrade python-django | May 8, 2023 | May 7, 2023 |
| Freebsd | — | Upgrade py38-django42Upgrade py311-django42Upgrade py310-django41Upgrade py39-django32Upgrade py311-django32Upgrade py310-django32Upgrade py38-django41Upgrade py39-django41Upgrade py39-django42Upgrade py311-django41Upgrade py310-django42Upgrade py38-django32Upgrade py37-django32 | Dec 10, 2025 | May 5, 2023 |
| Redhat_linux | — | Upgrade rubygem-unfUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-unicode-display_widthUpgrade rubygem-ffiUpgrade rubygem-mime-typesUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-oauth-ttyUpgrade satellite-maintainUpgrade rubygem-mime-types-dataUpgrade rubygem-powerbarUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foremanUpgrade satellite-cliUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-little-pluggerUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-rest-clientUpgrade rubygem-localeUpgrade satellite-cloneUpgrade rubygem-fast_gettextUpgrade rubygem-apipie-bindingsUpgrade rubygem-highlineUpgrade rubygem-amazing_printUpgrade rubygem-http-acceptUpgrade rubygem-snaky_hashUpgrade rubygem-version_gemUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-unf_extUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-gssapiUpgrade rubygem-oauthUpgrade rubygem-ffi-debuginfoUpgrade foreman-cliUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-unicodeUpgrade rubygem-hammer_cliUpgrade rubygem-unicode-debuginfoUpgrade rubygem-http-cookieUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-loggingUpgrade rubygem-domain_nameUpgrade rubygem-jwt | Nov 1, 2023 | May 7, 2023 |
| Rocky_linux | — | Upgrade libdb-utils-debuginfoUpgrade libdb-debuginfoUpgrade libdb-cxxUpgrade libdb-sql-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-debugsource | Mar 5, 2024 | May 7, 2023 |
| Suse | — | Upgrade python3-django | Jul 17, 2023 | May 7, 2023 |
| Ubuntu | — | Upgrade python3-django (Ubuntu Pro)Upgrade python-django (Ubuntu Pro)Upgrade python-djangoUpgrade python3-djangoUpgrade python-django-doc (Ubuntu Pro) | May 4, 2023 | May 3, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub