Published: 05/05/2021 Updated: 07/12/2023

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

In Django 2.2 prior to 2.2.21, 3.1 prior to 3.1.9, and 3.2 prior to 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.

Vulnerable Product	Search on Vulmon	Subscribe to Product
djangoproject django
debian debian linux 9.0
fedoraproject fedora 34
fedoraproject fedora 35

Debian Bug report logs - #988053 python-django: CVE-2021-31542 Package: python-django; Maintainer for python-django is Debian Python Team <team+python@trackerdebianorg>; Source for python-django is src:python-django (PTS, buildd, popcon) Reported by: "Chris Lamb" <lamby@debianorg> Date: Tue, 4 May 2021 11:15:02 U ...

A flaw was found in django ``MultiPartParser``, ``UploadedFile``, and ``FieldFile`` allowed directory-traversal via uploaded files with suitably crafted file names ...

A security issue has been found in Django before version 321 MultiPartParser, UploadedFile, and FieldFile allowed directory-traversal via uploaded files with suitably crafted file names In order to mitigate this risk, stricter basename and path sanitation is now applied Specifically, empty file names and paths with dot segments will be rejecte ...

oss-sec mailing list archives   By Date By Thread </form>    Django 321, 319, and 2221: CVE-2021-31542: Potential directory-traversal via uploaded files  ...

CWE-22 https://www.djangoproject.com/weblog/2021/may/04/security-releases/https://docs.djangoproject.com/en/3.2/releases/security/http://www.openwall.com/lists/oss-security/2021/05/04/3 https://lists.debian.org/debian-lts-announce/2021/05/msg00005.html https://security.netapp.com/advisory/ntap-20210618-0001/https://groups.google.com/forum/#%21forum/django-announce https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVKYPHR3TKR2ESWXBPOJEKRO2OSJRZUE/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/https://github.com/django/django/commit/04ac1624bdc2fa737188401757cf95ced122d26d https://github.com/django/django/commit/25d84d64122c15050a0ee739e859f22ddab5ac48 https://github.com/django/django/commit/c98f446c188596d4ba6de71d1b77b4a6c5c2a007 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=988053 https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2021-31542

CVE-2021-31542

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Mailing Lists

References

Vulmon Search

About

Products

Connect