CVE-2021-31542: Path Traversal
A flaw was found in django. MultiPartParser, UploadedFile, and FieldFile allowed directory-traversal via uploaded files with suitably crafted file names.
Other sources
A flaw was found in Django. MultiPartParser, UploadedFile, and FieldFile allowed directory-traversal via uploaded files with suitably crafted file names. The highest threat from this vulnerability is to data confidentiality.
In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.
Affected Software
Remediation
Patch Available
Patch Available
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-31542?
CVE-2021-31542 is a vulnerability found in Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1 that allows directory-traversal via uploaded files, potentially compromising data confidentiality.
How severe is CVE-2021-31542?
CVE-2021-31542 has a severity value of 7.5, which is considered high.
How can I fix CVE-2021-31542 in Django?
To fix CVE-2021-31542, make sure you upgrade Django to version 2.2.21, 3.1.9, or 3.2.1 depending on which version you are using.
Where can I find more information about CVE-2021-31542?
You can find more information about CVE-2021-31542 at the following references: [CVE Record](https://www.cve.org/CVERecord?id=CVE-2021-31542), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-31542), [Django Security Releases](https://www.djangoproject.com/weblog/2021/may/04/security-releases/), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=1954294), [Red Hat Advisory](https://access.redhat.com/errata/RHSA-2021:5070).
What is the Common Weakness Enumeration (CWE) associated with CVE-2021-31542?
The Common Weakness Enumeration (CWE) associated with CVE-2021-31542 are CWE-22 and CWE-434.