A security issue has been found in Django before version 3.2.1. MultiPartParser, UploadedFile, and FieldFile allowed directory-traversal via uploaded files with suitably crafted file names. In order to mitigate this risk, stricter basename and path sanitation is now applied. Specifically, empty file names and paths with dot segments will be rejected.
A security issue has been found in Django before version 3.2.1. MultiPartParser, UploadedFile, and FieldFile allowed directory-traversal via uploaded files with suitably crafted file names. In order to mitigate this risk, stricter basename and path sanitation is now applied. Specifically, empty file names and paths with dot segments will be rejected.
https://www.djangoproject.com/weblog/2021/may/04/security-releases/ https://github.com/django/django/commit/c98f446c188596d4ba6de71d1b77b4a6c5c2a007
Vulmon