django-s3file: Relative path traversal
Priority MEDIUM 49CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
django-s3file is a lightweight file upload input for Django and Amazon S3. Prior to 7.0.2, S3FileMiddleware is vulnerable to relative path traversal attacks, where an attacker can use a modified request to escape pre-signed upload locations and have the Django application load files from random locations into request.FILES. Depending on how files are handled, this may lead to confidentiality and integrity issues. This vulnerability is fixed in 7.0.2.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00565 47th percentileScored 2026-11-07
Fix Fixed django-s3file (codingjoe): 7.0.2django-s3file (PyPI): 7.0.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| codingjoe | django-s3file | before 7.0.2 | 7.0.2 | Patch available | CNA |
| — | django-s3file (PyPI) | before 7.0.2 | 7.0.2 | Patch available | GHSA-67qg-7284-2277 |
- django-s3file Vendorcodingjoe Affected before 7.0.2 Fixed in 7.0.2 Patch available CNA
- django-s3file (PyPI) Vendor— Affected before 7.0.2 Fixed in 7.0.2 Patch available GHSA-67qg-7284-2277
Remediation
- Fix · CNA django-s3file (codingjoe) Fixed in 7.0.2
- Fix · GHSA-67qg-7284-2277 django-s3file (PyPI) Fixed in 7.0.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-42196
- 2026-10-03 Alias added: GHSA-67qg-7284-2277
References
More codingjoe vulnerabilities
- TI-2025-30708 Django-Select2 Vulnerable to Widget Instance Secret Cache Key Leaking CVSS 3.1HIGH 8.2
Sources
- CVE-2026-42196 · CVE Program
- CVE-2026-42196 · NVD
- FIRST EPSS
- GHSA-67qg-7284-2277 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences