django-s3file is vulnerable to relative path traversal

CRITICAL 9.9CVE-2026-42196 · GHSA-67qg-7284-2277 · PYSEC-2026-328 · Published 12/05/2026 · updated 26/10/2026

Package	Affected versions	Patched versions
django-s3file PyPI	`< 7.0.2`	`7.0.2`

Description

Impact

S3FileMiddleware is vulnerable to relative path traversal attacks, where an attacker can use a modified request to escape pre-signed upload locations and have the Django application load files from random locations into request.FILES

Depending on how files are handled, this may lead to confidentiality and integrity issues.

Patches

Django-S3File urges all users to update to a patched version >=7.0.2.

NVD description

django-s3file is a lightweight file upload input for Django and Amazon S3. Prior to 7.0.2, S3FileMiddleware is vulnerable to relative path traversal attacks, where an attacker can use a modified request to escape pre-signed upload locations and have the Django application load files from random locations into request.FILES. Depending on how files are handled, this may lead to confidentiality and integrity issues. This vulnerability is fixed in 7.0.2.

References

codingjoe/django-s3file security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-42196 · ADVISORY
codingjoe/django-s3file · PACKAGE
pypa/advisory-database · WEB
pypi.org/project/django-s3file · WEB
GitHub Advisory GHSA-67qg-7284-2277 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

django-s3file

PyPI