CVE-2026-42196: django-s3file is vulnerable to relative path traversal
Impact S3FileMiddleware is vulnerable to relative path traversal attacks, where an attacker can use a modified request to escape pre-signed upload locations and have the Django application load files from random locations into request.FILES Depending on how files are handled, this may lead to confidentiality and integrity issues. Patches Django-S3File urges all users to update to a patched version =7.0.2.
Published May 5, 2026 · Updated May 13, 2026
Affected packages
django-s3file
- Ecosystem
- PyPI
- Affected
- <= 7.0.1
- Fixed in
- 7.0.2
- Check
pip show django-s3file
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Impact
S3FileMiddleware is vulnerable to relative path traversal attacks, where an attacker can use a modified request to escape pre-signed upload locations and have the Django application load files from random locations into request.FILES
Depending on how files are handled, this may lead to confidentiality and integrity issues.
Patches
Django-S3File urges all users to update to a patched version >=7.0.2.
Credited to stsewd, amureki.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology