VYPR
← All advisories
Moderate severityNVD Advisory· Published Apr 6, 2021· Updated Aug 3, 2024

CVE-2021-28658

CVE-2021-28658

Description

In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Django MultiPartParser in versions before 2.2.20, 3.0.14, and 3.1.8 allows directory traversal via crafted uploaded file names, enabling arbitrary file writes.

Vulnerability

Django versions 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8 contain a directory traversal vulnerability in the MultiPartParser component. When processing file uploads, the parser does not properly sanitize file names, allowing an attacker to include path traversal sequences (e.g., ../) in the filename. This affects all uses of the multipart parser, which is the default for handling HTTP file uploads. Built-in upload handlers are not affected [1][4].

Exploitation

An attacker must have the ability to submit a multipart form with a file upload to a Django application. No authentication is required if the endpoint accepts unauthenticated uploads. The attacker crafts a filename such as ../../etc/passwd or similar path traversal sequence and includes it as the file's Content-Disposition filename parameter. The MultiPartParser then writes the uploaded content to the location derived from the traversed path, under the server's configured upload directory [1].

Impact

Successful exploitation allows an attacker to write arbitrary files to the file system, limited only by the permissions of the Django process (typically the web server user). This can lead to overwriting application code, configuration files, or static files, potentially resulting in remote code execution, information disclosure, or denial of service [1].

Mitigation

The vulnerability is fixed in Django 2.2.20, 3.0.14, and 3.1.8, released on April 6, 2021 [4]. All users should upgrade to these versions or later. No workarounds are available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog as of the publication date.

References
  1. NVD - CVE-2021-28658
  2. Archive of security issues | Django documentation

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
DjangoPyPI
>= 2.2a1, < 2.2.202.2.20
DjangoPyPI
>= 3.0a1, < 3.0.143.0.14
DjangoPyPI
>= 3.1a1, < 3.1.83.1.8

Affected products

164

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

14

News mentions

0

No linked articles in our index yet.