DemoBook a demo

Vulnerability advisory

CVE-2023-31047

Published Updated OSV record ↗

Also known as BIT-django-2023-31047GHSA-r3xc-prgr-mg9pPYSEC-2023-61

Severity
  • CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected versions

Repository

Affected commitsFixed by commit
GIT github.com/django/django ↗
3591e1c1acbd7c13174275367c3fdf012cb0413b to before fc42edd2e63e89a80e7ca81486291f74359ef8befc42edd2e63e89a80e7ca81486291f74359ef8be
ef62a3a68c9d558486145a42c0d71ea9a76add9e to before dceb634ba42d3a182ea653dce31a529017f75a95dceb634ba42d3a182ea653dce31a529017f75a95
97aa3b7f08f51669e118f3af5ca91026e39664c3 through e829b0a239cffdeab5781df450a6b0e0026faa2dNo fix listed
Also listed as affected (3)
  • 4.2-NA
  • 4.2-b1
  • 4.2-rc1

Description

In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django's "Uploading multiple files" documentation suggested otherwise.

References

  • Codex
  • Claude Code
  • VS Code
  • GitHub Copilot
  • Cursor
  • Cline
  • Windsurf
  • Google Anti-gravity
  • OpenCode
  • Pi
  • Gemini CLI
  • Hermes Agent
  • Zed
  • Junie
  • Qwen Code
  • Kiro
  • Kilo Code
  • Factory Droid

Set up GitHits for your agents

Run this command:

<> bash
npx githits@latest init

What happens next:

  1. Opens your browser to authorize GitHits
  2. Asks whether to set up GitHits at the user or project level
  3. Detects your supported AI coding tools
  4. Lets you choose which tools to configure
  5. Configures the selected tools

Having trouble? Check our documentation.