CVE-2021-31542

Published: May 5, 2021Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.

Affected (6)

Products: Djangoproject: Django · Debian: Debian Linux · Fedoraproject: Fedora

1 product

1 product

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Djangoproject Django	From 2.2 to 2.2.21
Djangoproject Django	From 3.1 to 3.1.9
Djangoproject Django	From 3.2 to 3.2.1

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 9.0
Fedoraproject Fedora	Version 34
Fedoraproject Fedora	Version 35

Related CWEs

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (22)

http://www.openwall.com/lists/oss-security/2021/05/04/3

Source: cve@mitre.org

Mailing ListPatchThird Party Advisory

https://docs.djangoproject.com/en/3.2/releases/security/

Source: cve@mitre.org

PatchVendor Advisory

https://github.com/django/django/commit/04ac1624bdc2fa737188401757cf95ced122d26d

Source: cve@mitre.org

https://github.com/django/django/commit/25d84d64122c15050a0ee739e859f22ddab5ac48

Source: cve@mitre.org

https://github.com/django/django/commit/c98f446c188596d4ba6de71d1b77b4a6c5c2a007

Source: cve@mitre.org

https://groups.google.com/forum/#%21forum/django-announce

Source: cve@mitre.org

https://lists.debian.org/debian-lts-announce/2021/05/msg00005.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVKYPHR3TKR2ESWXBPOJEKRO2OSJRZUE/

Source: cve@mitre.org

https://security.netapp.com/advisory/ntap-20210618-0001/

Source: cve@mitre.org

Third Party Advisory

https://www.djangoproject.com/weblog/2021/may/04/security-releases/

Source: cve@mitre.org

Release NotesVendor Advisory

http://www.openwall.com/lists/oss-security/2021/05/04/3