CVE-2021-31542

Description

In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.

Weakness classification

• nvd@nist.gov: CWE-22

Primary references

• cve@mitre.org — Mailing List, Patch, Third Party Advisory
• cve@mitre.org — Patch, Vendor Advisory
• cve@mitre.org
• cve@mitre.org
• cve@mitre.org
• cve@mitre.org
• cve@mitre.org — Mailing List, Third Party Advisory
• cve@mitre.org
• cve@mitre.org
• cve@mitre.org — Third Party Advisory
• cve@mitre.org — Release Notes, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Patch, Third Party Advisory