CVE-2021-28658: Debian Linux

Medium severity, CVSS 5.3. EPSS: 3.9% chance of exploitation in the next 30 days.

In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability.

Affected products

• Debian Debian Linux: version 9.0 only
• Djangoproject Django: from 2.2, before 2.2.20 (fixed in 2.2.20); from 3.0, before 3.0.14 (fixed in 3.0.14); from 3.1, before 3.1.8 (fixed in 3.1.8)
• Fedoraproject Fedora: version 34 only

Published 2021-04-06. Last modified 2026-06-17.