What is GHSA-r3xc-prgr-mg9p?

Django bypasses validation when using one form field to upload multiple files This vulnerability has been assigned a severity rating of CRITICAL.

How do I check if my project is affected by GHSA-r3xc-prgr-mg9p?

Use GeekWala's free vulnerability scanner to check your dependencies against GHSA-r3xc-prgr-mg9p and 200,000+ other known vulnerabilities. Upload your package.json, requirements.txt, or other dependency file to get instant results.

GHSA-r3xc-prgr-mg9p

CRITICAL

Django bypasses validation when using one form field to upload multiple files

Published May 7, 2023Updated February 21, 2025Source: osv

Details

In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django's "Uploading multiple files" documentation suggested otherwise.

Remediation

Upgrade to the fixed version using your package manager.

pip

Update django to 3.2.19 or later

pip install "django>=3.2.19"

pip

Update django to 4.1.9 or later

pip install "django>=4.1.9"

pip

Update django to 4.2.1 or later

pip install "django>=4.2.1"

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (3)

Package	Ecosystem	Affected	Fixed In
django	PyPI	3.2, 3.2.1, 3.2.10, 3.2.11 (+18 more)	3.2.19
django	PyPI	4.0, 4.0.1, 4.0.10, 4.0.2 (+22 more)	4.1.9
django	PyPI	4.2, 4.2a1, 4.2b1, 4.2rc1	4.2.1

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-20
Improper Input ValidationMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 3.1 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Risk Assessment

CVSS Score

3.1

Exploitation is difficult or impact is minor. Address in your next planned update.

EPSS Score (30-day exploit probability)

0.10%

Higher than 29% of vulnerabilities

Also Known As

BIT-django-2023-31047

CVE-2023-31047

PYSEC-2023-61

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies