p PatchFirst

CVE-2026-42196

CVE-2026-42196 · django-s3file: Relative path traversal

This page contains facts from public vulnerability sources. Check the original advisory before updating.

django-s3file is a lightweight file upload input for Django and Amazon S3. Prior to 7.0.2, S3FileMiddleware is vulnerable to relative path traversal attacks, where an attacker can use a modified request to escape pre-signed upload locations and have the Django application load files from random locations into request.FILES. Depending on how files are handled, this may lead to confidentiality and integrity issues. This vulnerability is fixed in 7.0.2.

CVSS 9.9 · Critical · EPSS 0.6% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • django-s3file

    Versions
    • < 7.0.2: Affected

    No fix published

  • django-s3file PyPI

    Versions
    • 0.1.0
    • 0.1.1
    • 0.1.10
    • 0.1.11
    • 0.1.12
    • 0.1.13
    • 0.1.14
    • 0.1.15
    • 0.1.16
    • 0.1.17
    • 0.1.18
    • 0.1.19
    • 0.1.2
    • 0.1.20
    • 0.1.21
    • 0.1.22
    • 0.1.23
    • 0.1.3
    • 0.1.4
    • 0.1.5
    • 0.1.6
    • 0.1.7
    • 0.1.8
    • 0.1.9
    • 0.2.0
    • 0.3.0
    • 0.3.1
    • 0.3.2
    • 0.3.3
    • 0.3.4
    • 0.3.5
    • 0.3.6
    • 0.3.7
    • 0.4.0
    • 0.4.1
    • 0.5.0
    • 0.5.1
    • 0.5.2
    • 0.5.3
    • 0.5.4
    • 0.6.0
    • 0.6.1
    • 0.6.2
    • 1.0.0
    • 1.0.1
    • 1.0.2
    • 1.1.0
    • 1.2.0
    • 1.2.1
    • 2.0.0
    • 3.0.0
    • 3.0.1
    • 3.0.2
    • 3.0.3
    • 3.0.4
    • 3.0.5
    • 4.0.0
    • 4.0.1
    • 4.0.2
    • 4.1.0
    • 4.2.0
    • 5.0.0
    • 5.0.1
    • 5.0.2
    • 5.0.4
    • 5.0.5
    • 5.0.6
    • 5.1.0
    • 5.1.1
    • 5.1.2
    • 5.1.3
    • 5.2.0
    • 5.3.0
    • 5.4.0
    • 5.5.0
    • 5.5.1
    • 5.5.2
    • 5.5.3
    • 5.5.4
    • 5.5.5
    • 5.5.7
    • 6.0.1
    • 7.0.0
    • 7.0.1
    Affected ranges
    • ECOSYSTEM: < 7.0.2

    Update to 7.0.2

Original sources

Check your server →