CVE-2024-11404

File Upload Bypass in django Filer

5.5 MediumFix available

Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in django CMS Association django Filer allows Input Data Manipulation, Stored XSS.

This issue affects django Filer: from 3 before 3.3.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: Low

Exploit likelihood

0.38%Up 0.3 points since Nov 21, 2024

What each source reports

CVE List Score used 5.5

File Upload Bypass in django Filer

This issue affects django Filer: from 3 before 3.3.

Record: CVE-2024-11404
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Weakness: CWE-434, CWE-80
Updated: 2026-11-02

EUVDEUVD-2024-3360 5.5

This issue affects django Filer: from 3 before 3.3.

Record: EUVD-2024-3360
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Updated: 2026-11-02

GitHub AdvisoriesGHSA-j4v3-wwwx-5gqv 5.5

Django Filer Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type, Improper Input Validation, Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in django CMS Association django Filer allows Input Data Manipulation, Stored XSS.This issue affects django Filer: from 3 before 3.3.

Record: GHSA-j4v3-wwwx-5gqv
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Weakness: CWE-20, CWE-80, CWE-434
Updated: 2026-11-02

NVD 5.5

This issue affects django Filer: from 3 before 3.3.

Record: CVE-2024-11404
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Weakness: CWE-80, CWE-434
Updated: 2026-11-02

OSVGHSA-j4v3-wwwx-5gqv 5.5

Django Filer Unrestricted Upload of File with Dangerous Type

Record: GHSA-j4v3-wwwx-5gqv
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Weakness: CWE-20, CWE-434, CWE-80
Updated: 2026-11-02

OSVPYSEC-2026-1298 5.5

Django Filer Unrestricted Upload of File with Dangerous Type

Record: PYSEC-2026-1298
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Updated: 2026-11-02

Affected products

django cms association filer

Affected packages

Affected packages
Package	Affected	Fixed
`django-filer` PyPI	before 3.3.0	3.3.0
`django-filer` PyPI	before 3.3.0, plus listed versions 0.1.3a0.7.00.7.10.7.20.8.1 Show 45 moreShow less 0.8.20.8.30.8.40.8.50.8.60.8.70.90.9.10.9.100.9.110.9.120.9.20.9.30.9.40.9.50.9.60.9.70.9.80.9.91.0.01.0.11.0.21.0.31.0.41.0.51.0.61.1.01.1.11.2.01.2.11.2.21.2.31.2.41.2.51.2.61.2.6rc11.2.6rc21.2.71.2.81.3.01.3.11.3.21.4.01.4.11.4.2	3.3.0

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-11404 is a medium vulnerability (CVSS 5.5) in Django Cms Association Filer, published November 20, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 32nd percentile. Fixed in django-filer 3.3.0.

References

Show 4 moreShow less

This page doesn't list everything

Left out here: 45 versions. The JSON record has them.