CVE-2021-28658

In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file…

published April 6, 2021

CVSS
—
EPSS
4%
Percentile
90.1
In the wild
Unconfirmed
What it is

In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03865 · 90.1th percentile
Published
2021-04-06T14:51Z
EPSS history
Timeline
  • 06 APR 14:51Z
    In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file…
    cvelistv5