All vulnerabilities
CVE-2026-42196GHSA-67qg-7284-2277PYSEC-2026-328

django-s3file is vulnerable to relative path traversal

codingjoe django-s3filepipFrameworks
Open in ThreatlineRecord JSON
CVSS
9.9Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.56%Chance of exploitation activity in the next 30 days, higher than 46% of CVEs. Scored 27 Oct 2026FIRST EPSS
Fixed in7.0.2Fixed versionGitHub
Published12 May 2026Updated 27 Oct 2026CVE List

What fixes it

  • 7.0.2django-s3file, pipGitHub
  • 7.0.2django-s3file, PyPIOSVpip install "django-s3file>=7.0.2"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

S3FileMiddleware is vulnerable to relative path traversal attacks, where an attacker can use a modified request to escape pre-signed upload locations and have the Django application load files from random locations into request.FILES

Depending on how files are handled, this may lead to confidentiality and integrity issues.

Patches

Django-S3File urges all users to update to a patched version >=7.0.2.

Text from GitHub Advisory Database

Affected versions 53

  • django-s3file, pip<= 7.0.1GitHub
  • django-s3fileaffected: < 7.0.2CVE List
  • django-s3file, PyPIfrom first release, fixed in 7.0.2OSV
  • django-s3file, PyPI0.1.0OSV
  • django-s3file, PyPI0.1.1OSV
  • django-s3file, PyPI0.1.10OSV
  • django-s3file, PyPI0.1.11OSV
  • django-s3file, PyPI0.1.12OSV
  • django-s3file, PyPI0.1.13OSV
  • django-s3file, PyPI0.1.14OSV
  • django-s3file, PyPI0.1.15OSV
  • django-s3file, PyPI0.1.16OSV
  • django-s3file, PyPI0.1.17OSV
  • django-s3file, PyPI0.1.18OSV
  • django-s3file, PyPI0.1.19OSV
  • django-s3file, PyPI0.1.2OSV
  • django-s3file, PyPI0.1.20OSV
  • django-s3file, PyPI0.1.21OSV
  • django-s3file, PyPI0.1.22OSV
  • django-s3file, PyPI0.1.23OSV
  • django-s3file, PyPI0.1.3OSV
  • django-s3file, PyPI0.1.4OSV
  • django-s3file, PyPI0.1.5OSV
  • django-s3file, PyPI0.1.6OSV
  • django-s3file, PyPI0.1.7OSV
  • django-s3file, PyPI0.1.8OSV
  • django-s3file, PyPI0.1.9OSV
  • django-s3file, PyPI0.2.0OSV
  • django-s3file, PyPI0.3.0OSV
  • django-s3file, PyPI0.3.1OSV
  • django-s3file, PyPI0.3.2OSV
  • django-s3file, PyPI0.3.3OSV
  • django-s3file, PyPI0.3.4OSV
  • django-s3file, PyPI0.3.5OSV
  • django-s3file, PyPI0.3.6OSV
  • django-s3file, PyPI0.3.7OSV
  • django-s3file, PyPI0.4.0OSV
  • django-s3file, PyPI0.4.1OSV
  • django-s3file, PyPI0.5.0OSV
  • django-s3file, PyPI0.5.1OSV
  • django-s3file, PyPI0.5.2OSV
  • django-s3file, PyPI0.5.3OSV
  • django-s3file, PyPI0.5.4OSV
  • django-s3file, PyPI0.6.0OSV
  • django-s3file, PyPI0.6.1OSV
  • django-s3file, PyPI0.6.2OSV
  • django-s3file, PyPI1.0.0OSV
  • django-s3file, PyPI1.0.1OSV
  • django-s3file, PyPI1.0.2OSV
  • django-s3file, PyPI1.1.0OSV
  • django-s3file, PyPI1.2.0OSV
  • django-s3file, PyPI1.2.1OSV
  • django-s3file, PyPI2.0.0OSV

References 5