AIKIDO-2024-10457
django-filer is vulnerable to Unrestricted Upload of File with Dangerous Type
43
Medium Risk
This Affects:
django-filerTL;DR
Affected versions of this package allow users to upload binary files by default, which can potentially include malicious code. This vulnerability may lead to remote code execution (RCE) or other serious security threats.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
django-filer is vulnerable to Unrestricted Upload of File with Dangerous Type in versions 0.5.2a1 - 3.2.3.
How to fix this
Upgrade the django-filer library to the patch version or make sure application/octet-stream is blocked from uploading.
Links
GitHub Release
Other
iltosec.com/blog/post/cve-2024-11404-medium-severity-file-upload-vulnerabilities-in-django-filer-323/pypi.org/project/django-filer/django-cms.org/en/blog/2024/11/19/security-updates-for-django-filer-and-django-cms-attributes-field/usom.gov.tr/bildirim/tr-24-1864
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant