CVE-2011-0697: Cross-Site Scripting (XSS) Vulnerability in Django
Summary
CVE-2011-0697: Cross-site scripting (XSS) vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 might allow remote attackers to inject arbitrary web script or HTML via a filename associated with a file upload. Affects django across 2 version ranges.
>= 1.1, < 1.1.4
>= 1.2, < 1.2.5
Fixed in 1.1.4 or 1.2.5, depending on the release line you run. How to fix ↓
Also tracked for
- python-django · Debian:11
The same CVE-2011-0697 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework known for its simplicity and scalability. It provides a robust set of tools and features for building web applications. This vulnerability affects Django versions 1.1.x before 1.1.4 and 1.2.x before 1.2.5. Django allows users to upload files, and this vulnerability arises from improper handling of filenames associated with file uploads.
Vulnerability Detail
The vulnerability in Django allows remote attackers to inject arbitrary web script or HTML through a filename associated with a file upload. This can lead to cross-site scripting (XSS) attacks, where malicious scripts are executed in the context of a victim's browser. The impact of this vulnerability can range from unauthorized data disclosure to full control of the affected user's session.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.1, < 1.1.41.1.4pip install --upgrade "django==1.1.4" -
>= 1.2, < 1.2.51.2.5pip install --upgrade "django==1.2.5"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading Django is not immediately feasible, a temporary workaround is to manually sanitize filenames before processing file uploads. This can be done by implementing a validation mechanism that checks for potentially malicious characters or patterns in filenames and rejects them if found.
Conclusion
The Cross-Site Scripting (XSS) vulnerability in Django versions 1.1.x before 1.1.4 and 1.2.x before 1.2.5 can allow remote attackers to inject arbitrary web script or HTML through file uploads. It is crucial to upgrade Django to the recommended versions or apply the provided workaround to mitigate the risk of XSS attacks and potential data disclosure or session hijacking. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
The vulnerability allows attackers to inject malicious scripts or HTML, potentially leading to cross-site scripting attacks and unauthorized data disclosure or session hijacking.
Django versions 1.1.x before 1.1.4 and 1.2.x before 1.2.5 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock, and Vulert will analyze it for potential vulnerabilities.
Yes, upgrading Django to version 1.1.4 or later (for Django 1.1.x) or version 1.2.5 or later (for Django 1.2.x) will address this vulnerability.
A temporary workaround is to implement filename sanitization in your application's file upload process. This involves validating filenames for potentially malicious characters or patterns and rejecting them if found.
Related vulnerabilities
Recent vulnerabilities recorded for django.
