{"action":"Upgrade django to 3.2.19 or later.","affected":[{"fixed":"3.2.19","introduced":"3.2a1"},{"fixed":"4.1.9","introduced":"4.0a1"},{"fixed":"4.2.1","introduced":"4.2a1"}],"component":"django","cve_ids":["CVE-2023-31047"],"ecosystem":"PyPI","epss":0.01391,"exploited":false,"fixed_versions":["3.2.19","4.1.9","4.2.1"],"ghsa_id":"GHSA-r3xc-prgr-mg9p","id":"tcs_01M5KFX3QFS8XZ96GY1QGDTFSC","modified_at":"2025-02-21T05:31:37.748535Z","published_at":"2023-05-07T03:30:17Z","references":["https://osv.dev/vulnerability/GHSA-r3xc-prgr-mg9p","https://nvd.nist.gov/vuln/detail/CVE-2023-31047","https://github.com/django/django/commit/21b1b1fc03e5f9e9f8c977ee6e35618dd3b353dd","https://github.com/django/django/commit/e7c3a2ccc3a562328600be05068ed9149e12ce64","https://github.com/django/django/commit/eed53d0011622e70b936e203005f0e6f4ac48965","https://docs.djangoproject.com/en/4.2/releases/security","https://github.com/django/django","https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2023-61.yaml","https://groups.google.com/forum/#!forum/django-announce","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A45VKTUVQ2BN6D5ZLZGCM774R6QGFOHW","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DNEHD6N435OE2XUFGDAAVAXSYWLCUBFD","https://security.netapp.com/advisory/ntap-20230609-0008","https://www.djangoproject.com/weblog/2023/may/03/security-releases"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-r3xc-prgr-mg9p","url":"https://osv.dev/vulnerability/GHSA-r3xc-prgr-mg9p"}],"summary":"Django bypasses validation when using one form field to upload multiple files"}