PYSEC-2026-1316
Dosage vulnerable to a Directory Traversal through crafted HTTP responses
Quick fix
PYSEC-2026-1316 — dosage: upgrade to the fixed version with the command below.
pip install --upgrade 'dosage>=3.2'Details
### Impact
When downloadinging comic images, Dosage constructs target file names from different aspects of the remote comic (page URL, image URL, page content, etc.). While the basename is properly stripped of directory-traversing characters, the file extension is taken from the HTTP `Content-Type` header. This allows a remote attacker (or a Man-in-the-Middle, if the comic is served over HTTP) to write arbitrary files outside the target directory (if additional conditions are met).
### Patches
Fixed in release 3.2. The [fix is small and self-contained](https://github.com/webcomics/dosage/commit/336a9684191604bc49eed7296b74bd582151181e), so distributors might elect to backport the fix to older versions.
### Workarounds
No
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://github.com/webcomics/dosage/security/advisories/GHSA-4vcx-3pj3-44m7[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2025-64184[ADVISORY]
- https://github.com/webcomics/dosage/commit/336a9684191604bc49eed7296b74bd582151181e[WEB]
- https://github.com/webcomics/dosage[PACKAGE]
- https://pypi.org/project/dosage[PACKAGE]
- https://github.com/advisories/GHSA-4vcx-3pj3-44m7[ADVISORY]