CVE-2021-28658: Path Traversal
'MultiPartParser' allowed directory-traversal via uploaded files with suitably crafted file names.
Other sources
In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-28658?
CVE-2021-28658 is a vulnerability in Django versions 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8 that allows directory traversal via uploaded files with suitably crafted file names.
How does CVE-2021-28658 impact Django?
CVE-2021-28658 impacts Django by allowing malicious users to perform directory traversal by exploiting the vulnerability in the MultiPartParser.
What software versions are affected by CVE-2021-28658?
The versions of Django affected by CVE-2021-28658 are 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8.
How severe is the vulnerability CVE-2021-28658?
The severity of CVE-2021-28658 is medium, with a severity score of 5.3.
How can I fix CVE-2021-28658?
To fix CVE-2021-28658, you should update Django to versions 2.2.20, 3.0.14, or 3.1.8.