{"action":"Upgrade django-filer to 3.3.0 or later.","affected":[{"fixed":"3.3.0","introduced":"0"}],"component":"django-filer","cve_ids":["CVE-2024-11404"],"ecosystem":"PyPI","epss":0.00379,"exploited":false,"fixed_versions":["3.3.0"],"ghsa_id":"GHSA-j4v3-wwwx-5gqv","id":"tcs_01M5KFN3HBMFRNDKF4C12KEWBH","modified_at":"2026-07-07T17:56:49.600313034Z","published_at":"2024-11-20T12:30:35Z","references":["https://osv.dev/vulnerability/GHSA-j4v3-wwwx-5gqv","https://nvd.nist.gov/vuln/detail/CVE-2024-11404","https://github.com/django-cms/django-filer/commit/f8209a6507680661bd134cd30878993b79ef3344","https://github.com/django-cms/django-filer","https://iltosec.com/blog/post/cve-2024-11404-medium-severity-file-upload-vulnerabilities-in-django-filer-323","https://iltosec.com/blog/post/djangocms-attributes-field-300-stored-xss-vulnerability","https://pypi.org/project/django-filer","https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-1864","https://www.django-cms.org/en/blog/2024/11/19/security-updates-for-django-filer-and-django-cms-attributes-field","https://www.usom.gov.tr/bildirim/tr-24-1864"],"severity":{"label":"medium","score":5.5},"sources":[{"source":"osv","source_id":"GHSA-j4v3-wwwx-5gqv","url":"https://osv.dev/vulnerability/GHSA-j4v3-wwwx-5gqv"}],"summary":"Django Filer Unrestricted Upload of File with Dangerous Type"}