critical vulnerability

django-s3file is vulnerable to relative path traversal

Fix availableCritical · CVSS 9.9EPSS 0.56%

Published May 5, 2026 · updated Oct 27, 2026

What to do

Upgrade to a fixed version: django-s3file 7.0.2.
Redeploy and restart long-running processes so they load the fixed code.

Affected packages

PyPIdjango-s3file2,005 downloads/week

Vulnerable versions: <= 7.0.1
Fixed in: 7.0.2

Check your project: pip show django-s3file

Sources

GitHub Advisory GHSA-67qg-7284-2277
NVD CVE-2026-42196

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') · CWE-23 Relative Path Traversal · CWE-26 Path Traversal: '/dir/../filename'

← All critical vulnerabilities