Path Traversal in Django

ALTO 7.5CVE-2021-31542 · BIT-django-2021-31542 · GHSA-rxjp-mfm9-w4wr · Published 05/05/2021 · updated 17/06/2026

In breve

CVE-2021-31542 è una vulnerabilità ALTO (CVSS 7.5) che riguarda django, django (djangoproject).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 5.3%, superiore al 92.6% delle vulnerabilità.
Correzione: aggiornare a 2.2.21, 3.1.9, 3.2.1 o successiva.

Package	Affected versions	Patched versions
django PyPI	`≥ 2.2, < 2.2.21≥ 3.0, < 3.1.9≥ 3.1, < 3.1.9≥ 3.2, < 3.2.1`	`2.2.213.1.93.2.1`
django djangoproject	`≥ 2.2, < 2.2.21≥ 3.1, < 3.1.9≥ 3.2, < 3.2.1`	`2.2.213.1.93.2.1`

Description

In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.

NVD description

In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.

References

Altre vulnerabilità di django

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

django

PyPI

≥ 2.2, < 2.2.21≥ 3.0, < 3.1.9≥ 3.1, < 3.1.9≥ 3.2, < 3.2.1

2.2.213.1.93.2.1

django

djangoproject

≥ 2.2, < 2.2.21≥ 3.1, < 3.1.9≥ 3.2, < 3.2.1

2.2.213.1.93.2.1

Description

In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.

NVD description

In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.

Altre vulnerabilità di django

Vedi tutto →