{"schema":"threatline.record/2","record":{"id":"GHSA-pcjh-6r5h-r92r","aliases":["GHSA-pcjh-6r5h-r92r"],"summary":"django-sendfile2 before 0.7.0 contains reflected file download vulnerability","details":"Similar to CVE-2022-36359 for Django, django-sendfile2 did not protect against a reflected file download attack in version 0.6.1 and earlier. If the file name used by django-sendfile2 was derived from user input, then it would be possible to perform a such an attack. A new version of django-sendfile2 will be released. Either download django-sendfile2 0.7.0 as a workaround or sanitize user input yourself, using Django's patch as a template: https://github.com/django/django/commit/bd062445cffd3f6cc6dcd20d13e2abed818fa173","categories":["Frameworks"],"product":"django-sendfile2","vendor":"","ecosystem":"pip","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-pcjh-6r5h-r92r","source_modified_at":"2026-10-24T06:30:30Z","fetched_at":"2026-10-24T10:48:42.330819Z","package":{"ecosystem":"pip","name":"django-sendfile2"},"range":"< 0.7.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-pcjh-6r5h-r92r","source_modified_at":"2024-12-03T06:06:56.847569Z","fetched_at":"2026-10-24T10:48:42.330819Z","package":{"name":"django-sendfile2","ecosystem":"PyPI","purl":"pkg:pypi/django-sendfile2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0"}]}],"versions":["0.4.0","0.4.1","0.4.2","0.4.3","0.5.1","0.6.0","0.6.1"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-pcjh-6r5h-r92r","source_modified_at":"2026-10-24T06:30:30Z","fetched_at":"2026-10-24T10:48:42.330819Z","package":{"ecosystem":"pip","name":"django-sendfile2"},"version":"0.7.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-pcjh-6r5h-r92r","source_modified_at":"2024-12-03T06:06:56.847569Z","fetched_at":"2026-10-24T10:48:42.330819Z","package":{"name":"django-sendfile2","ecosystem":"PyPI","purl":"pkg:pypi/django-sendfile2"},"version":"0.7.0"}],"cvss":null,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2022-08-11T18:12:35Z","modified_at":"2026-10-24T06:30:30Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-pcjh-6r5h-r92r","fetched_at":"2026-10-24T10:48:42.330819Z","source_modified_at":"2026-10-24T06:30:30Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-pcjh-6r5h-r92r","fetched_at":"2026-10-24T10:48:42.330819Z","source_modified_at":"2024-12-03T06:06:56.847569Z"}],"sources":["GitHub Advisory Database","OSV"],"references":[{"url":"https://github.com/moggers87/django-sendfile2/security/advisories/GHSA-pcjh-6r5h-r92r","source":"GitHub Advisory Database"},{"url":"https://github.com/moggers87/django-sendfile2/commit/4c370859023292e3715200a57843f86c5ef3cd77","source":"GitHub Advisory Database"},{"url":"https://github.com/moggers87/django-sendfile2/releases/tag/v0.7.0","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-pcjh-6r5h-r92r","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-24T06:30:30Z","content_hash":"77ca9d23e5360ecabd9b1aeb306f7204a4aa9125cff959d65bee6f4574155d88"}}