CVE-2026-42196

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-42196
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42196.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-42196
Aliases
Published
2026-05-12T20:58:02Z
Modified
2026-08-12T03:51:12Z
Severity
  • 9.9 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N CVSS Calculator
Summary
django-s3file: Relative path traversal
Details

django-s3file is a lightweight file upload input for Django and Amazon S3. Prior to 7.0.2, S3FileMiddleware is vulnerable to relative path traversal attacks, where an attacker can use a modified request to escape pre-signed upload locations and have the Django application load files from random locations into request.FILES. Depending on how files are handled, this may lead to confidentiality and integrity issues. This vulnerability is fixed in 7.0.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22",
        "CWE-26"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42196.json"
}
References

Affected packages

Git / github.com/codingjoe/django-s3file

Affected ranges

Type
GIT
Repo
https://github.com/codingjoe/django-s3file
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8fce36bddd0b622badff02c5da49fd705fb29852
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "7.0.2"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

0.*
0.5.1
0.5.2
0.5.3
0.5.4
0.6.0
1.*
1.0.0
1.0.1
1.0.2
1.1.0
1.2.0
1.2.1
2.*
2.0.0
3.*
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
4.*
4.0.0
4.0.1
4.0.2
4.1.0
4.2.0
5.*
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.1.0
5.1.1
5.1.2
5.1.3
5.2.0
5.3.0
5.4.0
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
6.*
6.0.0
6.0.1
7.*
7.0.0
7.0.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42196.json"