Which versions of django-s3file are affected by CVE-2026-42196?

django-s3file versions 7.0.1 and earlier contain a path traversal vulnerability in S3FileMiddleware that allows attackers to bypass upload location restrictions and force applications to load…. A patch is available.

How to fix or mitigate CVE-2026-42196?

Within 24 hours: Identify all Django applications using django-s3file and verify their current version via pip show django-s3file or requirements.txt audit. Within 7 days: Upgrade all affected instances to django-s3file version 7.0.2 or later, test in staging environment, and deploy to production with validation that S3 upload location restrictions are enforced. Within 30 days: Review S3 bucket policies and application file processing logic to confirm no malicious files were previously loaded, and implement input validation on file paths independent of middleware.

django-s3file CVE-2026-42196

Q: What is the CVSS score of CVE-2026-42196?

CVE-2026-42196 has a CVSS 4.0 base score of 9.9 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

CRITICAL

Relative Path Traversal (CWE-23)

2026-05-05 https://github.com/codingjoe/django-s3file

GHSA-67qg-7284-2277

Python Path Traversal

9.9

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.9 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

May 12, 2026 - 22:22 vuln.today

cvss_changed

CVSS changed

May 12, 2026 - 22:22 NVD

9.9 (CRITICAL)

Source Code Evidence Fetched

May 05, 2026 - 21:01 vuln.today

Analysis Generated

May 05, 2026 - 21:01 vuln.today

DescriptionGitHub Advisory

Impact

S3FileMiddleware is vulnerable to relative path traversal attacks, where an attacker can use a modified request to escape pre-signed upload locations and have the Django application load files from random locations into request.FILES

Depending on how files are handled, this may lead to confidentiality and integrity issues.

Patches

Django-S3File urges all users to update to a patched version >=7.0.2.

AnalysisAI

Path traversal in django-s3file's S3FileMiddleware allows attackers to manipulate HTTP requests and force Django applications to load arbitrary files from unintended S3 locations into request.FILES, bypassing pre-signed upload location restrictions. Affects all versions <=7.0.1. Vendor-confirmed vulnerability with patch released in version 7.0.2. No active exploitation confirmed (not in CISA KEV). CVSS metrics not available, but path traversal combined with file handling operations presents moderate confidentiality and integrity risk depending on application-specific file processing logic.

Technical ContextAI

Django-s3file is a Python middleware library that facilitates direct S3 uploads in Django applications by handling pre-signed S3 URLs and populating request.FILES with uploaded content. The vulnerability resides in S3FileMiddleware's input validation logic, specifically CWE-23 (Relative Path Traversal). The middleware fails to properly sanitize or canonicalize file path parameters in HTTP requests before retrieving files from S3. Attackers can inject relative path sequences (likely '../' traversal patterns) to escape the intended pre-signed upload directory scope and reference arbitrary S3 objects within the bucket or accessible storage. This allows unauthorized file access outside the application's expected upload boundaries, violating the security contract of pre-signed URLs which should restrict uploads to specific object keys.

RemediationAI

Immediately upgrade django-s3file to version 7.0.2 or later using pip install --upgrade django-s3file==7.0.2 or updating requirements.txt and redeploying. Vendor advisory confirms version 7.0.2 contains the fix for path validation in S3FileMiddleware (https://github.com/codingjoe/django-s3file/security/advisories/GHSA-67qg-7284-2277). If immediate upgrade is not feasible, implement compensating controls: (1) add custom middleware before S3FileMiddleware to validate and sanitize file path parameters, rejecting requests containing '../', encoded traversal sequences, or paths resolving outside expected prefixes; (2) restrict S3 bucket IAM policies to enforce least-privilege access scoping uploaded objects to specific prefixes, limiting traversal impact; (3) implement additional application-layer validation on request.FILES to verify file origins match expected S3 keys before processing. Note that workarounds do not eliminate the vulnerability and may interfere with legitimate file upload workflows; upgrading remains the definitive remediation.