PT-2026-35817 · Pypi · Django-S3File

CVE-2026-42196 · Published 2026-04-28 · Updated 2026-06-29

Positive Technologies (AI Summary)

CVSS v4.0

9.9

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions django-s3file versions prior to 7.0.2

Description S3FileMiddleware is susceptible to relative path traversal, allowing an attacker to use a modified request to escape pre-signed upload locations. This enables the Django application to load files from arbitrary locations into request.FILES, which may result in confidentiality and integrity issues.

Recommendations Update to version 7.0.2 or later.

Exploit

Fix

Relative Path Traversal

Path traversal

Weakness Enumeration

CWE-23

CWE-22

CWE-26

Related Identifiers

CVE-2026-42196

GHSA-67QG-7284-2277

PYSEC-2026-328

Affected Products

Django-S3File

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42196.json · Exploit
• https://osv.dev/vulnerability/PYSEC-2026-328 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42196 · Security Note
• https://osv.dev/vulnerability/GHSA-67qg-7284-2277 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-42196 · Vendor Advisory
• https://github.com/codingjoe/django-s3file · Note
• https://github.com/codingjoe/django-s3file/security/advisories/GHSA-67qg-7284-2277 · Note
• https://twitter.com/stsewd/status/2049156993554768209 · Twitter Post
• https://pypi.org/project/django-s3file · Note
• https://twitter.com/CVEnew/status/2054324000709591393 · Twitter Post
• https://github.com/advisories/GHSA-67qg-7284-2277 · Note