Description
In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django's "Uploading multiple files" documentation suggested otherwise.
References (6)
Core 6
Core References
Vendor Advisory
https://docs.djangoproject.com/en/4.2/releases/security/
Vendor Advisory
https://security.netapp.com/advisory/ntap-20230609-0008/
Mailing List, Third Party Advisory vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A45VKTUVQ2BN6D5ZLZGCM774R6QGFOHW/
Mailing List, Third Party Advisory vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DNEHD6N435OE2XUFGDAAVAXSYWLCUBFD/
Scores
CVSS v3
9.8
EPSS
0.0017
EPSS Percentile
38.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
total
Details
CWE
CWE-862
CWE-20
Status
published
Products (4)
djangoproject/django
4.2 (3 CPE variants)
djangoproject/django
3.2 - 3.2.19
fedoraproject/fedora
38
pypi/Django
3.2a1 - 3.2.19PyPI
Published
May 07, 2023
Tracked Since
Feb 18, 2026