---
id: GHSA-pcjh-6r5h-r92r
title: django-sendfile2 before 0.7.0 contains reflected file download vulnerability
summary: django-sendfile2 before 0.7.0 contains reflected file download vulnerability
severity: high
cwe:
  - CWE-20
vendor: django-sendfile2
product: django-sendfile2
ecosystem: pip
affected:
  - django-sendfile2 < 0.7.0
patched:
  - django-sendfile2 0.7.0
published: '2022-08-11'
updated: '2026-10-24'
sourceUpdated: '2026-10-24T06:30:30Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-pcjh-6r5h-r92r'
references:
  - url: >-
      https://github.com/moggers87/django-sendfile2/security/advisories/GHSA-pcjh-6r5h-r92r
  - url: >-
      https://github.com/moggers87/django-sendfile2/commit/4c370859023292e3715200a57843f86c5ef3cd77
  - url: 'https://github.com/moggers87/django-sendfile2/releases/tag/v0.7.0'
  - url: 'https://github.com/advisories/GHSA-pcjh-6r5h-r92r'
tags:
  - ghsa
  - pip
ingestedAt: '2026-10-24T06:53:46.598Z'
---

## Overview

Similar to CVE-2022-36359 for Django, django-sendfile2 did not protect against a reflected file download attack in version 0.6.1 and earlier. If the file name used by django-sendfile2 was derived from user input, then it would be possible to perform a such an attack. A new version of django-sendfile2 will be released. Either download django-sendfile2 0.7.0 as a workaround or sanitize user input yourself, using Django's patch as a template: https://github.com/django/django/commit/bd062445cffd3f6cc6dcd20d13e2abed818fa173

## Affected packages

- `django-sendfile2 < 0.7.0`

## Remediation

Upgrade to a patched release:

- `django-sendfile2 0.7.0`