File Upload Validation Bypass in Django Framework

CVE-2023-31047

What is CVE-2023-31047?

In versions of Django prior to 3.2.19 and 4.1.9, the framework allowed users to bypass validation checks when uploading multiple files through form fields designed for single file uploads. This discrepancy stems from misleading documentation that suggested multiple file handling was supported by forms.FileField and forms.ImageField. Consequently, only the last file submitted in a multi-upload instance was subjected to validation checks, posing a potential risk to applications utilizing these features.

References