id: PYSEC-2023-61
details: In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was
  possible to bypass validation when using one form field to upload multiple files.
  This multiple upload has never been supported by forms.FileField or forms.ImageField
  (only the last uploaded file was validated). However, Django's "Uploading multiple
  files" documentation suggested otherwise.
affected:
- package:
    name: django
    ecosystem: PyPI
    purl: pkg:pypi/django
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "3.2"
    - fixed: 3.2.19
    - introduced: "4.0"
    - fixed: 4.1.9
    - introduced: "4.2"
    - fixed: 4.2.1
  versions:
  - "3.2"
  - 3.2.1
  - 3.2.10
  - 3.2.11
  - 3.2.12
  - 3.2.13
  - 3.2.14
  - 3.2.15
  - 3.2.16
  - 3.2.17
  - 3.2.18
  - 3.2.2
  - 3.2.3
  - 3.2.4
  - 3.2.5
  - 3.2.6
  - 3.2.7
  - 3.2.8
  - 3.2.9
  - 3.2a1
  - 3.2b1
  - 3.2rc1
  - "4.0"
  - 4.0.1
  - 4.0.10
  - 4.0.2
  - 4.0.3
  - 4.0.4
  - 4.0.5
  - 4.0.6
  - 4.0.7
  - 4.0.8
  - 4.0.9
  - "4.1"
  - 4.1.1
  - 4.1.2
  - 4.1.3
  - 4.1.4
  - 4.1.5
  - 4.1.6
  - 4.1.7
  - 4.1.8
  - 4.1a1
  - 4.1b1
  - 4.1rc1
  - "4.2"
  - 4.2a1
  - 4.2b1
  - 4.2rc1
references:
- type: ADVISORY
  url: https://www.djangoproject.com/weblog/2023/may/03/security-releases/
- type: ADVISORY
  url: https://docs.djangoproject.com/en/4.2/releases/security/
- type: ARTICLE
  url: https://groups.google.com/forum/#!forum/django-announce
- type: REPORT
  url: 
    https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A45VKTUVQ2BN6D5ZLZGCM774R6QGFOHW/
- type: WEB
  url: 
    https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A45VKTUVQ2BN6D5ZLZGCM774R6QGFOHW/
- type: ADVISORY
  url: https://github.com/advisories/GHSA-r3xc-prgr-mg9p
aliases:
- CVE-2023-31047
- GHSA-r3xc-prgr-mg9p
modified: "2023-06-05T01:12:51.525399Z"
published: "2023-05-07T02:15:00Z"