A vulnerability exists in the File Upload Endpoint of DjangoBlog when the SECRET_KEY argument is manipulated, causing the application to fall back to a hard‑coded cryptographic key. This defeats the intended key management and can expose any data protected by that key, potentially granting attackers read or write access to encrypted content. The CVE description states that an attacker can perform this manipulation remotely and that the exploit, while possible, is rated high in complexity and reported as difficult.

All installations of liangliangyy DjangoBlog version 2.1.0.0 or earlier are affected. The vulnerability is tied to the settings.py component within that product and is not limited to specific deployment environments or auxiliary services.

The CVSS score of 2.3 categorizes this issue as low severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, and the exploitability is reported as difficult, meaning that while an attacker can eventually succeed, a higher level of skill or familiarity with the application would be required. This combination yields a moderate overall risk that warrants assessment of the current key management posture.