CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2021-31542
High (7.5). EPSS 5.3% chance of exploitation in the next 30 days. Fixed in django 2.2.21, 3.1.9, 3.2.1.
In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.
Severity
- EPSS
- 5.3% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-10-31)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- djangoproject:django
- fedoraproject:fedora
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-rxjp-mfm9-w4wr | PyPI | django | >=2.2 <2.2.21 | 2.2.21 |
| GHSA-rxjp-mfm9-w4wr | PyPI | django | >=3.0 <3.1.9 | 3.1.9 |
| GHSA-rxjp-mfm9-w4wr | PyPI | django | >=3.2 <3.2.1 | 3.2.1 |
| PYSEC-2021-7 | PyPI | django | >=2.2 <2.2.21 >=3.1 <3.1.9 >=3.2 <3.2.1 | 2.2.21, 3.1.9, 3.2.1 |
References
- http://www.openwall.com/lists/oss-security/2021/05/04/3
- https://docs.djangoproject.com/en/3.2/releases/security/
- https://github.com/django/django/commit/04ac1624bdc2fa737188401757cf95ced122d26d
- https://github.com/django/django/commit/25d84d64122c15050a0ee739e859f22ddab5ac48
- https://github.com/django/django/commit/c98f446c188596d4ba6de71d1b77b4a6c5c2a007