CVE-2021-28658

Name of the Vulnerable Software and Affected Versions Django versions 2.2 before 2.2.20 Django versions 3.0 before 3.0.14 Django versions 3.1 before 3.1.8

Description The issue is related to the MultiPartParser component in Django, which has a directory path restriction flaw. This flaw can be exploited by a remote attacker using files with specially crafted names, potentially allowing access to confidential data. The built-in upload handlers are not affected by this issue.

Recommendations For Django versions 2.2 before 2.2.20, update to version 2.2.20 or later. For Django versions 3.0 before 3.0.14, update to version 3.0.14 or later. For Django versions 3.1 before 3.1.8, update to version 3.1.8 or later.