Skip to content
OpenAdvisories
Critical USN-6054-2 1 CVE

python-django vulnerability

Published May 25, 2023 · Updated Jun 29, 2026

Ecosystem: Ubuntu

Summary

USN-6054-1 fixed a vulnerability in Django. This update provides
the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.

Original advisory details:

Moataz Al-Sharida and nawaik discovered that Django incorrectly handled
uploading multiple files using one form field. A remote attacker could
possibly use this issue to bypass certain validations.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS python-django 1.6.11-0ubuntu1.3+esm6
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS python-django 1.8.7-1ubuntu5.15+esm7

Vulnerabilities 1

  • Critical 9.8
    CVE-2023-31047

    Django bypasses validation when using one form field to upload multiple files

    In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last u…

    python-django django python-django Debian Ubuntu PyPI

References

  • report
    https://ubuntu.com/security/CVE-2023-31047