—
PYSEC-2026-328
django-s3file is vulnerable to relative path traversal
Quick fix
PYSEC-2026-328 — django-s3file: upgrade to the fixed version with the command below.
pip install --upgrade 'django-s3file>=7.0.2'Details
### Impact `S3FileMiddleware` is vulnerable to relative path traversal attacks, where an attacker can use a modified request to escape pre-signed upload locations and have the Django application load files from random locations into `request.FILES`
Depending on how files are handled, this may lead to confidentiality and integrity issues.
### Patches Django-S3File urges all users to update to a patched version >=7.0.2.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://github.com/codingjoe/django-s3file/security/advisories/GHSA-67qg-7284-2277[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2026-42196[ADVISORY]
- https://github.com/codingjoe/django-s3file[PACKAGE]
- https://pypi.org/project/django-s3file[PACKAGE]
- https://github.com/advisories/GHSA-67qg-7284-2277[ADVISORY]