CVE-2011-0697: Cross-Site Scripting Vulnerability in Django
Summary
CVE-2011-0697: Cross-site scripting in django. Affects django across 2 version ranges.
>= 1.1, < 1.1.4
>= 1.2, < 1.2.5
Fixed in 1.1.4 or 1.2.5, depending on the release line you run. How to fix ↓
Also tracked for
- python-django · Debian:11
The same CVE-2011-0697 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework known for its simplicity and scalability. It provides a robust set of tools and features for building web applications. However, versions 1.1.x before 1.1.4 and 1.2.x before 1.2.5 of Django are susceptible to a moderate severity cross-site scripting (XSS) vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via a filename associated with a file upload.
Vulnerability Detail
The cross-site scripting (XSS) vulnerability in Django arises from a lack of proper input sanitization when handling filenames during file uploads. Attackers can exploit this vulnerability by uploading a file with a malicious filename that contains script or HTML code. When the uploaded file is accessed or displayed, the injected code gets executed in the context of the vulnerable web application, potentially leading to unauthorized actions, data theft, or further attacks.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.1, < 1.1.41.1.4pip install --upgrade "django==1.1.4" -
>= 1.2, < 1.2.51.2.5pip install --upgrade "django==1.2.5"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. Upgrading to the fixed versions is the recommended solution.
Conclusion
The cross-site scripting vulnerability in Django versions 1.1.x before 1.1.4 and 1.2.x before 1.2.5 poses a moderate risk to web applications built using these versions. Upgrading to the fixed versions is strongly recommended to mitigate the vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
This vulnerability allows remote attackers to execute arbitrary script or HTML code in the context of the vulnerable Django application, potentially leading to unauthorized actions, data theft, or further attacks.
No, only versions 1.1.x before 1.1.4 and 1.2.x before 1.2.5 are affected. Upgrading to the fixed versions mitigates the vulnerability.
There are no known public exploits available for this vulnerability at the time of writing. However, it is advisable to apply the recommended fix as soon as possible to prevent potential attacks.
Yes, this vulnerability can be exploited remotely by sending a specially crafted file upload request to the vulnerable Django application.
No, the provided vulnerability details do not include a CVSS score.
References
Related vulnerabilities
Recent vulnerabilities recorded for django.
