{
  "cveId": "CVE-2023-31047",
  "url": "https://patchblox.com/security/cve/CVE-2023-31047",
  "summary": "CVE-2023-31047 is fixed in 3 products on 1 platform, first by python-django 1:1.11.11-1ubuntu1.21, released May 3, 2023. It is not reported as exploited. Patch Radar priority: Urgent.",
  "title": "python-django: In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using...",
  "description": "In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django\u0027s \u0022Uploading multiple files\u0022 documentation suggested otherwise.",
  "published": "2023-05-03T06:00:00Z",
  "severity": "critical",
  "cvss": 9.8,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.01391,
  "epssPercentile": 0.72519,
  "priority": "Urgent",
  "priorityTier": 2,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "python-django",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "3:3.2.19-1",
      "fix": "DEBIAN-CVE-2023-31047",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-31047",
      "released": "2023-05-07T02:15:08Z"
    },
    {
      "platform": "linux",
      "product": "python-django",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "3:3.2.19-1",
      "fix": "DEBIAN-CVE-2023-31047",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-31047",
      "released": "2023-05-07T02:15:08Z"
    },
    {
      "platform": "linux",
      "product": "python-django",
      "release": "Debian 14",
      "fixedVersion": "3:3.2.19-1",
      "fix": "DEBIAN-CVE-2023-31047",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-31047",
      "released": "2023-05-07T02:15:08Z"
    },
    {
      "platform": "linux",
      "product": "python-django",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1:1.11.11-1ubuntu1.21",
      "fix": "python-django 1:1.11.11-1ubuntu1.21",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-python-django-1-1.11.11-1ubuntu1.21",
      "released": "2023-05-03T06:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python-django-common",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1:1.11.11-1ubuntu1.21",
      "fix": "python-django-common 1:1.11.11-1ubuntu1.21",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-python-django-common-1-1.11.11-1ubuntu1.21",
      "released": "2023-05-03T06:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-django",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1:1.11.11-1ubuntu1.21",
      "fix": "python3-django 1:1.11.11-1ubuntu1.21",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-python3-django-1-1.11.11-1ubuntu1.21",
      "released": "2023-05-03T06:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-django",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "2:2.2.12-1ubuntu0.17",
      "fix": "python3-django 2:2.2.12-1ubuntu0.17",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-python3-django-2-2.2.12-1ubuntu0.17",
      "released": "2023-05-03T06:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-django",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "2:3.2.12-2ubuntu1.6",
      "fix": "python3-django 2:3.2.12-2ubuntu1.6",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-python3-django-2-3.2.12-2ubuntu1.6",
      "released": "2023-05-03T06:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}