CVE-2023-31047 Django bypasses validation when using one form field to upload multiple files
Attackers can bypass file upload validation by submitting multiple files, potentially uploading malicious content despite intended security checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-31047?
CVE-2023-31047 is a critical missing authorization vulnerability in Djangoproject Django, published on 7 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django's "Uploading multiple files" documentation suggested otherwise.
Which versions are affected by CVE-2023-31047?
8 open source packages ship an affected version, including django and Django. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
django Bitnami | From 3.2.0 to 4.2.0 | 3.2.19, 4.1.9 |
django PyPI | From 3.2 | 3.2.19, 4.1.9, 4.2.1 |
django PyPI | From 3.2a1 | 3.2.19 |
django PyPI | From 4.0a1 | 4.1.9 |
django PyPI | From 4.2a1 | 4.2.1 |
Django PyPI | From 3.2a1 | 3.2.19 |
2 more packages
Django PyPI | From 4.0a1 | 4.1.9 |
Django PyPI | From 4.2a1 | 4.2.1 |
Linux distribution packages (1)
python-Django openSUSE:Tumbleweed | All versions | 4.2.1-1.1 |
Products include Djangoproject Django, Fedoraproject Fedora.
How do I fix CVE-2023-31047?
Upgrade django to a fixed version for your release line: 3.2.19, 4.1.9 or 4.2.1.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-31047 being exploited?
There is no known exploitation of CVE-2023-31047 in the wild and no public exploit code.
Other vulnerabilities in Djangoproject Django
- CVE-2026-4277 Privilege abuse in GenericInlineModelAdmin
- CVE-2024-53908 Django SQL injection in HasKey(lhs, rhs) on Oracle
- CVE-2024-42005 Django SQL injection vulnerability
- CVE-2022-34265 Django `Trunc()` and `Extract()` database functions vulnerable to SQL Injection
- CVE-2021-35042 SQL Injection in Django
Sources
Also known as BIT-django-2023-31047, CLSA-2026-1786021276, DEBIAN-CVE-2023-31047, DLA-3415-1, GHSA-r3xc-prgr-mg9p, OESA-2023-1286 and 5 more.