CVE-2026-42196criticalCWE-22CWE-26

CVE-2026-42196: falha crítica em codingjoe django-s3file

django-s3file: Relative path traversal

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar django-s3file+ Monitorar django-s3file

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.9epss 0.6%
django-s3file is a lightweight file upload input for Django and Amazon S3. Prior to 7.0.2, S3FileMiddleware is vulnerable to relative path traversal attacks, where an attacker can use a modified request to escape pre-signed upload locations and have the Django application load files from random locations into request.FILES. Depending on how files are handled, this may lead to confidentiality and integrity issues. This vulnerability is fixed in 7.0.2.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Produtos afetados
codingjoe · django-s3file
CVEs relacionadas — codingjoe django-s3file

No mesmo produto, das mais perigosas para as menos.

CVE-2022-24840CRITICALImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in django-s3fileEPSS 2.1%