All vulnerabilities
GHSA-pcjh-6r5h-r92r

django-sendfile2 before 0.7.0 contains reflected file download vulnerability

django-sendfile2pipFrameworks
Open in ThreatlineRecord JSON
CVSS
n/aHigh
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in0.7.0Fixed versionGitHub
Published11 Aug 2022Updated 24 Oct 2026GitHub

What fixes it

  • 0.7.0django-sendfile2, pipGitHub
  • 0.7.0django-sendfile2, PyPIOSVpip install "django-sendfile2>=0.7.0"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Similar to CVE-2022-36359 for Django, django-sendfile2 did not protect against a reflected file download attack in version 0.6.1 and earlier. If the file name used by django-sendfile2 was derived from user input, then it would be possible to perform a such an attack. A new version of django-sendfile2 will be released. Either download django-sendfile2 0.7.0 as a workaround or sanitize user input yourself, using Django's patch as a template: https://github.com/django/django/commit/bd062445cffd3f6cc6dcd20d13e2abed818fa173

Text from GitHub Advisory Database

Affected versions 9

  • django-sendfile2, pip< 0.7.0GitHub
  • django-sendfile2, PyPIfrom first release, fixed in 0.7.0OSV
  • django-sendfile2, PyPI0.4.0OSV
  • django-sendfile2, PyPI0.4.1OSV
  • django-sendfile2, PyPI0.4.2OSV
  • django-sendfile2, PyPI0.4.3OSV
  • django-sendfile2, PyPI0.5.1OSV
  • django-sendfile2, PyPI0.6.0OSV
  • django-sendfile2, PyPI0.6.1OSV

References 4