tocsin

PyPI/django CVE-2021-28658: unknown, EPSS 3.86%

In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not

Action: Upgrade django to 2.2.20 or later.

pip install django==2.2.20
pip install django==3.0.14
pip install django==3.1.8

Affected

introducedfixedlast affected
2.22.2.20-
3.03.0.14-
3.13.1.8-

Fixed versions

2.2.203.0.143.1.8

Sources

CVE-2021-28658 · published · modified · JSON