critical vulnerability

Path Traversal in django-s3file

Fix availableCritical · CVSS 9.3EPSS 2.1%

Published Jun 6, 2022 · updated Oct 28, 2026

What to do

Upgrade to a fixed version: django-s3file 5.5.1.
Redeploy and restart long-running processes so they load the fixed code.

Affected packages

PyPIdjango-s3file2,005 downloads/week

Vulnerable versions: < 5.5.1
Fixed in: 5.5.1

Check your project: pip show django-s3file

Sources

GitHub Advisory GHSA-4w8f-hjm9-xwgf
NVD CVE-2022-24840

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') · CWE-96 Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')

← All critical vulnerabilities