Skip to content
OpenAdvisories
Critical USN-6054-1 1 CVE

python-django vulnerability

Published May 3, 2023 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Moataz Al-Sharida and nawaik discovered that Django incorrectly handled
uploading multiple files using one form field. A remote attacker could
possibly use this issue to bypass certain validations.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS python-django 1:1.11.11-1ubuntu1.21
Ubuntu · 20.04 LTS 20.04:LTS python-django 2:2.2.12-1ubuntu0.17
Ubuntu · 22.04 LTS 22.04:LTS python-django 2:3.2.12-2ubuntu1.6

Vulnerabilities 1

  • Critical 9.8
    CVE-2023-31047

    Django bypasses validation when using one form field to upload multiple files

    In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last u…

    python-django django python-django Debian Ubuntu PyPI

References

  • report
    https://ubuntu.com/security/CVE-2023-31047