critical
CVE-2023-31047
python-django: Potential bypass of validation when uploading multiple files using one form field
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy's own label is CRITICAL. Rated critical by NVD, GHSA, Bitnami. Rated lower by Red Hat (medium), Ubuntu (low).
Description
In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django's "Uploading multiple files" documentation suggested otherwise.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | django | 3.2.19, 4.1.9 |
| pip::GitHub Security Advisory pip | django | 3.2.19, 4.1.9, 4.2.1 |
| debian 10 | python-django | 1:1.11.29-1+deb10u8 |
| debian 11 | python-django | 2:2.2.28-1~deb11u2 |
| debian 12 | python-django | 3:3.2.19-1 |
| debian 13 | python-django | 3:3.2.19-1 |
| debian 14 | python-django | 3:3.2.19-1 |
| echo | python-django | 3:3.2.19-1 |
| Red Hat | python-django, python2-django | no fix listed |
| ubuntu 14.04-ESM | python-django | 1.6.11-0ubuntu1.3+esm6 |
| ubuntu 16.04-ESM | python-django | 1.8.7-1ubuntu5.15+esm7 |
| ubuntu 18.04 | python-django | 1:1.11.11-1ubuntu1.21 |
Show all 19 entries from 18 sources
| Source | Package | Fixed in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | django | 3.2.19, 4.1.9 |
| pip::GitHub Security Advisory pip | django | 3.2.19, 4.1.9, 4.2.1 |
| debian 10 | python-django | 1:1.11.29-1+deb10u8 |
| debian 11 | python-django | 2:2.2.28-1~deb11u2 |
| debian 12 | python-django | 3:3.2.19-1 |
| debian 13 | python-django | 3:3.2.19-1 |
| debian 14 | python-django | 3:3.2.19-1 |
| echo | python-django | 3:3.2.19-1 |
| Red Hat | python-django | no fix listed |
| Red Hat | python2-django | no fix listed |
| ubuntu 14.04-ESM | python-django | 1.6.11-0ubuntu1.3+esm6 |
| ubuntu 16.04-ESM | python-django | 1.8.7-1ubuntu5.15+esm7 |
| ubuntu 18.04 | python-django | 1:1.11.11-1ubuntu1.21 |
| ubuntu 18.04-ESM | python-django | 1:1.11.11-1ubuntu1.21 |
| ubuntu 20.04 | python-django | 2:2.2.12-1ubuntu0.17 |
| ubuntu 20.04-ESM | python-django | 2:2.2.12-1ubuntu0.17 |
| ubuntu 22.04 | python-django | 2:3.2.12-2ubuntu1.6 |
| ubuntu 22.10 | python-django | 3:3.2.15-1ubuntu1.3 |
| ubuntu 23.04 | python-django | 3:3.2.18-1ubuntu0.1 |
References
- https://access.redhat.com/security/cve/CVE-2023-31047
- https://docs.djangoproject.com/en/4.2/releases/security
- https://docs.djangoproject.com/en/4.2/releases/security/
- https://github.com/django/django
- https://github.com/django/django/commit/21b1b1fc03e5f9e9f8c977ee6e35618dd3b353dd
- https://github.com/django/django/commit/e7c3a2ccc3a562328600be05068ed9149e12ce64
- https://github.com/django/django/commit/eed53d0011622e70b936e203005f0e6f4ac48965
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2023-61.yaml
All 22 references
- https://groups.google.com/forum/#!forum/django-announce
- https://groups.google.com/forum/#%21forum/django-announce
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A45VKTUVQ2BN6D5ZLZGCM774R6QGFOHW
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A45VKTUVQ2BN6D5ZLZGCM774R6QGFOHW/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DNEHD6N435OE2XUFGDAAVAXSYWLCUBFD
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DNEHD6N435OE2XUFGDAAVAXSYWLCUBFD/
- https://nvd.nist.gov/vuln/detail/CVE-2023-31047
- https://security.netapp.com/advisory/ntap-20230609-0008
- https://security.netapp.com/advisory/ntap-20230609-0008/
- https://ubuntu.com/security/notices/USN-6054-1
- https://ubuntu.com/security/notices/USN-6054-2
- https://www.cve.org/CVERecord?id=CVE-2023-31047
- https://www.djangoproject.com/weblog/2023/may/03/security-releases
- https://www.djangoproject.com/weblog/2023/may/03/security-releases/