Created attachment 866611 [details]
Attached patches

CVE-2023-31047: Potential bypass of validation when uploading multiple files using one form field
=================================================================================================

Uploading multiple files using one form field has never been supported by
``forms.FileField`` or ``forms.ImageField`` as only the last uploaded file was
validated. Unfortunately, "Uploading multiple files" topic suggested otherwise.

In order to avoid the vulnerability, ``ClearableFileInput`` and
``django.forms.FileInput`` form widgets now raise ``ValueError`` when
the ``multiple`` HTML attribute is set on them. To prevent the exception and
keep the old behavior, set ``allow_multiple_selected`` to ``True``.

For more details on using the new attribute and handling of multiple files
through a single field, see "Uploading multiple files".

This issue has Low severity, according to the Django security policy [1].

Affected versions
=================

* Django main development branch
* Django 4.2
* Django 4.1
* Django 3.2

Resolution
==========

Included with this email are patches implementing the changes described above
for each affected version of Django. On the release date, these patches will be
applied to the Django development repository and the following releases will be
issued along with disclosure of the issues:

* Django 4.2.1
* Django 4.1.9
* Django 3.2.19

[1] https://www.djangoproject.com/security/