---
id: CVE-2026-42196
aliases:
  - GHSA-67qg-7284-2277
  - PYSEC-2026-328
title: django-s3file is vulnerable to relative path traversal
summary: django-s3file is vulnerable to relative path traversal
severity: critical
vendor: django-s3file
product: django-s3file
ecosystem: pip
affected:
  - django-s3file < 7.0.2
patched:
  - django-s3file 7.0.2
published: '2026-05-05'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T16:30:07.533969166Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-67qg-7284-2277'
references:
  - url: >-
      https://github.com/codingjoe/django-s3file/security/advisories/GHSA-67qg-7284-2277
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-42196'
  - url: 'https://github.com/codingjoe/django-s3file'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/django-s3file/PYSEC-2026-328.yaml
  - url: 'https://pypi.org/project/django-s3file'
  - url: 'https://github.com/advisories/GHSA-67qg-7284-2277'
tags:
  - osv
  - pip
  - ghsa
epss: 0.00565
epssPercentile: 0.46736
cwe:
  - CWE-22
  - CWE-23
  - CWE-26
ingestedAt: '2026-10-27T16:32:34.357Z'
---

## Overview

### Impact
`S3FileMiddleware` is vulnerable to relative path traversal attacks, where an attacker can use a modified request to escape pre-signed upload locations and have the Django application load files from random locations into `request.FILES`

Depending on how files are handled, this may lead to confidentiality and integrity issues.

### Patches
Django-S3File urges all users to update to a patched version >=7.0.2.

## Affected packages

- `django-s3file < 7.0.2`

## Remediation

Upgrade to a patched release:

- `django-s3file 7.0.2`