CVE-2024-11404 File Upload Bypass in django Filer
Attackers can upload dangerous files to execute code or inject scripts, affecting users of the django Filer library.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-11404?
CVE-2024-11404 is a medium-severity vulnerability in django Filer, published on 20 Nov 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in django CMS Association django Filer allows Input Data Manipulation, Stored XSS.
This issue affects django Filer: from 3 before 3.3.
Which versions are affected by CVE-2024-11404?
3 open source packages ship an affected version, including django-filer.
| Package | Affected | Fixed in |
|---|---|---|
django-filer PyPI | All versions | 3.3.0 |
django-filer PyPI | All versions | 3.3.0 |
django-filer PyPI | All versions | 3.3.0 |
How do I fix CVE-2024-11404?
Upgrade django-filer to 3.3.0 or later.
Is CVE-2024-11404 being exploited?
There is no known exploitation of CVE-2024-11404 in the wild and no public exploit code.
Sources
Also known as GHSA-j4v3-wwwx-5gqv, PYSEC-2026-1298.