CVE-2021-31542: Debian Linux

High severity, CVSS 7.5. EPSS: 5.3% chance of exploitation in the next 30 days.

In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.

Affected products

• Debian Debian Linux: version 9.0 only
• Djangoproject Django: from 2.2, before 2.2.21 (fixed in 2.2.21); from 3.1, before 3.1.9 (fixed in 3.1.9); from 3.2, before 3.2.1 (fixed in 3.2.1)
• Fedoraproject Fedora: version 34 only; version 35 only

Published 2021-05-05. Last modified 2026-06-17.