May 4, 2021
Django 3.1.9 fixes a security issue in 3.1.8.
MultiPartParser
, UploadedFile
, and FieldFile
allowed
directory-traversal via uploaded files with suitably crafted file names.
In order to mitigate this risk, stricter basename and path sanitation is now applied. Specifically, empty file names and paths with dot segments will be rejected.
Jul 27, 2021