# Django 6.0.2 documentation

# Django 4.1.9 release notes

May 3, 2023

Django 4.1.9 fixes a security issue with severity “low” in 4.1.8.

## CVE-2023-31047: Potential bypass of validation when uploading multiple files using one form field

Uploading multiple files using one form field has never been supported by `forms.FileField` or `forms.ImageField` as only the last uploaded file was validated. Unfortunately, Uploading multiple files topic suggested otherwise.

In order to avoid the vulnerability, `ClearableFileInput` and `FileInput` form widgets now raise `ValueError` when the `multiple` HTML attribute is set on them. To prevent the exception and keep the old behavior, set `allow_multiple_selected` to `True`.

For more details on using the new attribute and handling of multiple files through a single field, see Uploading multiple files.