{"id":"CVE-2026-42196","aliases":["GHSA-67qg-7284-2277","PYSEC-2026-328"],"title":"django-s3file is vulnerable to relative path traversal","summary":"django-s3file is vulnerable to relative path traversal","severity":"critical","vendor":"django-s3file","product":"django-s3file","ecosystem":"pip","affected":["django-s3file < 7.0.2"],"patched":["django-s3file 7.0.2"],"published":"2026-05-05","updated":"2026-10-27","sourceUpdated":"2026-10-27T16:30:07.533969166Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-67qg-7284-2277","references":[{"url":"https://github.com/codingjoe/django-s3file/security/advisories/GHSA-67qg-7284-2277"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42196"},{"url":"https://github.com/codingjoe/django-s3file"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/django-s3file/PYSEC-2026-328.yaml"},{"url":"https://pypi.org/project/django-s3file"},{"url":"https://github.com/advisories/GHSA-67qg-7284-2277"}],"tags":["osv","pip","ghsa"],"epss":0.00565,"epssPercentile":0.46736,"cwe":["CWE-22","CWE-23","CWE-26"],"ingestedAt":"2026-10-27T16:32:34.357Z","slug":"CVE-2026-42196","body":"## Overview\n\n### Impact\n`S3FileMiddleware` is vulnerable to relative path traversal attacks, where an attacker can use a modified request to escape pre-signed upload locations and have the Django application load files from random locations into `request.FILES`\n\nDepending on how files are handled, this may lead to confidentiality and integrity issues.\n\n### Patches\nDjango-S3File urges all users to update to a patched version >=7.0.2.\n\n## Affected packages\n\n- `django-s3file < 7.0.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `django-s3file 7.0.2`","depth":"midnight","depthScore":52,"depthScoreParts":{"impact":52.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}