CVE-2021-28658
In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability.
02 / AFFECTED SOFTWARE
Affected packages
51 explicit affected versions
42 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability.
In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability.
In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability.
In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability.
05 / REFERENCES
Further evidence
- https://docs.djangoproject.com/en/3.1/releases/security/
- https://groups.google.com/g/django-announce/c/ePr5j-ngdPU
- https://lists.debian.org/debian-lts-announce/2021/04/msg00008.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVKYPHR3TKR2ESWXBPOJEKRO2OSJRZUE/
- https://security.netapp.com/advisory/ntap-20210528-0001/
- https://www.djangoproject.com/weblog/2021/apr/06/security-releases/
- https://nvd.nist.gov/vuln/detail/CVE-2021-28658
- https://docs.djangoproject.com/en/3.1/releases/security
- https://github.com/advisories/GHSA-xgxc-v2qg-chmh
- https://github.com/django/django
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2021-6.yaml
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ZVKYPHR3TKR2ESWXBPOJEKRO2OSJRZUE
- https://pypi.org/project/Django
- https://security.netapp.com/advisory/ntap-20210528-0001
- https://www.djangoproject.com/weblog/2021/apr/06/security-releases
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ZVKYPHR3TKR2ESWXBPOJEKRO2OSJRZUE/