PYSEC-2026-328
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/django-s3file/PYSEC-2026-328.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-328
- Aliases
- Published
- 2026-06-29T11:50:49Z
- Modified
- 2026-07-13T16:15:23Z
- Severity
-
- 9.9 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N CVSS Calculator
- Summary
- django-s3file is vulnerable to relative path traversal
- Details
-
Impact
S3FileMiddlewareis vulnerable to relative path traversal attacks, where an attacker can use a modified request to escape pre-signed upload locations and have the Django application load files from random locations intorequest.FILESDepending on how files are handled, this may lead to confidentiality and integrity issues.
Patches
Django-S3File urges all users to update to a patched version >=7.0.2.
- References
Affected packages
PyPI / django-s3file
Package
- Name
- django-s3file
- View open source insights on deps.dev
- Purl
- pkg:pypi/django-s3file
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed7.0.2
Affected versions
0.*
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.9
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14
0.1.15
0.1.16
0.1.17
0.1.18
0.1.19
0.1.20
0.1.21
0.1.22
0.1.23
0.2.0
0.3.0
0.3.1
0.3.2
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.4.0
0.4.1
0.5.0
0.5.1
0.5.2
0.5.3
0.5.4
0.6.0
0.6.1
0.6.2
1.*
1.0.0
1.0.1
1.0.2
1.1.0
1.2.0
1.2.1
2.*
2.0.0
3.*
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
4.*
4.0.0
4.0.1
4.0.2
4.1.0
4.2.0
5.*
5.0.0
5.0.1
5.0.2
5.0.4
5.0.5
5.0.6
5.1.0
5.1.1
5.1.2
5.1.3
5.2.0
5.3.0
5.4.0
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.7
6.*
6.0.1
7.*
7.0.0
7.0.1