Django bypasses validation when using one form field to upload multiple files
Critical severity
GitHub Reviewed
Published
May 7, 2023
to the GitHub Advisory Database
•
Updated Apr 3, 2024
Package
Affected versions
>= 3.2, < 3.2.19
>= 4.0, < 4.1.9
>= 4.2, < 4.2.1
Patched versions
3.2.19
4.1.9
4.2.1
Description
Published by the National Vulnerability Database
May 7, 2023
Published to the GitHub Advisory Database
May 7, 2023
Reviewed
May 9, 2023
Last updated
Apr 3, 2024
In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django's "Uploading multiple files" documentation suggested otherwise.
References