{"id":"GHSA-pcjh-6r5h-r92r","title":"django-sendfile2 before 0.7.0 contains reflected file download vulnerability","summary":"django-sendfile2 before 0.7.0 contains reflected file download vulnerability","severity":"high","cwe":["CWE-20"],"vendor":"django-sendfile2","product":"django-sendfile2","ecosystem":"pip","affected":["django-sendfile2 < 0.7.0"],"patched":["django-sendfile2 0.7.0"],"published":"2022-08-11","updated":"2026-10-24","sourceUpdated":"2026-10-24T06:30:30Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-pcjh-6r5h-r92r","references":[{"url":"https://github.com/moggers87/django-sendfile2/security/advisories/GHSA-pcjh-6r5h-r92r"},{"url":"https://github.com/moggers87/django-sendfile2/commit/4c370859023292e3715200a57843f86c5ef3cd77"},{"url":"https://github.com/moggers87/django-sendfile2/releases/tag/v0.7.0"},{"url":"https://github.com/advisories/GHSA-pcjh-6r5h-r92r"}],"tags":["ghsa","pip"],"ingestedAt":"2026-10-24T06:53:46.598Z","slug":"GHSA-pcjh-6r5h-r92r","body":"## Overview\n\nSimilar to CVE-2022-36359 for Django, django-sendfile2 did not protect against a reflected file download attack in version 0.6.1 and earlier. If the file name used by django-sendfile2 was derived from user input, then it would be possible to perform a such an attack. A new version of django-sendfile2 will be released. Either download django-sendfile2 0.7.0 as a workaround or sanitize user input yourself, using Django's patch as a template: https://github.com/django/django/commit/bd062445cffd3f6cc6dcd20d13e2abed818fa173\n\n## Affected packages\n\n- `django-sendfile2 < 0.7.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `django-sendfile2 0.7.0`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}