CVE-2023-31047: Input Validation
In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django's "Uploading multiple files" documentation suggested otherwise.
Other sources
Potential bypass of validation when uploading multiple files using one form field
Uploading multiple files using one form field has never been supported by forms.FileField or forms.ImageField as only the last uploaded file was validated. Unfortunately, "Uploading multiple files" topic suggested otherwise.
In order to avoid the vulnerability, ClearableFileInput and django.forms.FileInput form widgets now raise ValueError when the multiple HTML attribute is set on them. To prevent the exception and keep the old behavior, set allowmultipleselected to True.
For more details on using the new attribute and handling of multiple files through a single field, see "Uploading multiple files".
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-31047.
What is the severity rating of CVE-2023-31047?
CVE-2023-31047 has a severity rating of 9.8 (Critical).
How can I bypass validation when uploading multiple files using one form field in Django?
To bypass validation when uploading multiple files using one form field in Django, you should update to Django version 3.2.19, 4.1.9, or 4.2.1 or apply the appropriate remedies specified by your software vendor.
Which Django versions are affected by CVE-2023-31047?
Django versions 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1 are affected by CVE-2023-31047.
Where can I find more information about CVE-2023-31047?
You can find more information about CVE-2023-31047 in the following references: 1. [Django Security Releases](https://www.djangoproject.com/weblog/2023/may/03/security-releases/) 2. [Django 4.2 Security Releases](https://docs.djangoproject.com/en/4.2/releases/security/) 3. [Django Announce Google Group](https://groups.google.com/forum/#!forum/django-announce)