id: PYSEC-2026-1298
published: "2026-07-07T14:34:45.291287Z"
modified: "2026-07-07T17:24:00.610125Z"
aliases:
- CVE-2024-11404
- GHSA-j4v3-wwwx-5gqv
summary: Django Filer Unrestricted Upload of File with Dangerous Type
details: "Unrestricted Upload of File with Dangerous Type, Improper Input Validation, Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in django CMS Association django Filer allows Input Data Manipulation, Stored XSS.This issue affects django Filer: from 3 before 3.3."
affected:
- package:
    name: django-filer
    ecosystem: PyPI
    purl: pkg:pypi/django-filer
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 3.3.0
  versions:
  - 0.1.3a
  - 0.7.0
  - 0.7.1
  - 0.7.2
  - 0.8.1
  - 0.8.2
  - 0.8.3
  - 0.8.4
  - 0.8.5
  - 0.8.6
  - 0.8.7
  - "0.9"
  - 0.9.1
  - 0.9.10
  - 0.9.11
  - 0.9.12
  - 0.9.2
  - 0.9.3
  - 0.9.4
  - 0.9.5
  - 0.9.6
  - 0.9.7
  - 0.9.8
  - 0.9.9
  - 1.0.0
  - 1.0.1
  - 1.0.2
  - 1.0.3
  - 1.0.4
  - 1.0.5
  - 1.0.6
  - 1.1.0
  - 1.1.1
  - 1.2.0
  - 1.2.1
  - 1.2.2
  - 1.2.3
  - 1.2.4
  - 1.2.5
  - 1.2.6
  - 1.2.6rc1
  - 1.2.6rc2
  - 1.2.7
  - 1.2.8
  - 1.3.0
  - 1.3.1
  - 1.3.2
  - 1.4.0
  - 1.4.1
  - 1.4.2
  - 1.4.3
  - 1.4.4
  - 1.5.0
  - 1.6.0
  - 1.7.0
  - 1.7.1
  - 2.0.0
  - 2.0.1
  - 2.0.2
  - "2.1"
  - 2.1.1
  - 2.1.2
  - 2.1rc1
  - 2.1rc2
  - 2.1rc3
  - 2.1rc4
  - "2.2"
  - 2.2.1
  - 2.2.2
  - 2.2.3
  - 2.2.4
  - 2.2.5
  - 2.2.6
  - 2.2.7
  - 2.2.8
  - 2.3rc1
  - 3.0.0
  - 3.0.0rc1
  - 3.0.0rc2
  - 3.0.0rc3
  - 3.0.1
  - 3.0.2
  - 3.0.3
  - 3.0.4
  - 3.0.5
  - 3.0.6
  - 3.1.0
  - 3.1.1
  - 3.1.2
  - 3.1.3
  - 3.1.4
  - 3.2.0
  - 3.2.1
  - 3.2.2
  - 3.2.3
references:
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2024-11404
- type: WEB
  url: https://github.com/django-cms/django-filer/commit/f8209a6507680661bd134cd30878993b79ef3344
- type: PACKAGE
  url: https://github.com/django-cms/django-filer
- type: WEB
  url: https://iltosec.com/blog/post/cve-2024-11404-medium-severity-file-upload-vulnerabilities-in-django-filer-323
- type: WEB
  url: https://iltosec.com/blog/post/djangocms-attributes-field-300-stored-xss-vulnerability
- type: WEB
  url: https://pypi.org/project/django-filer
- type: WEB
  url: https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-1864
- type: WEB
  url: https://www.django-cms.org/en/blog/2024/11/19/security-updates-for-django-filer-and-django-cms-attributes-field
- type: WEB
  url: https://www.usom.gov.tr/bildirim/tr-24-1864
- type: ADVISORY
  url: https://github.com/advisories/GHSA-j4v3-wwwx-5gqv
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L