CVE-2024-11404

Advisory

Affected versions of django-filer are vulnerable to Unrestricted Upload of File with Dangerous Type (CWE-434). This vulnerability allows attackers to upload malicious binary files, potentially leading to data breaches or system compromise. The attack vector involves uploading crafted files through the application's upload functionality. The vulnerability exists due to permissive file validators that accept binary uploads without proper checks. To mitigate, upgrade to django-filer version which restricts binary and unknown file uploads by default and requires explicit validation and virus scanning for such files.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/django-cms/django-filer/commit/f8209a6507680661bd134cd30878993b79ef3344
• https://github.com/advisories/GHSA-j4v3-wwwx-5gqv
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-11404