Vulnerability · Published May 12, 2026 · Assigned by GitHub_M
CVE-2026-42196django-s3file: Relative path traversal
Critical 9.9
In plain English
A critical-severity path traversal in django-s3file from codingjoe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
django-s3file is a lightweight file upload input for Django and Amazon S3. Prior to 7.0.2, S3FileMiddleware is vulnerable to relative path traversal attacks, where an attacker can use a modified request to escape pre-signed upload locations and have the Django application load files from random locations into request.FILES. Depending on how files are handled, this may lead to confidentiality and integrity issues. This vulnerability is fixed in 7.0.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | django-s3file | 7.0.2 | GHSA-67qg-7284-2277 |
| PyPI | django-s3file | 7.0.2 | PYSEC-2026-328 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| codingjoe | django-s3file | < 7.0.2 |
Weakness: CWE-22, CWE-26 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N