Django S3File
Approved changes feed: RSS · Atom
cpe:2.3:a:codingjoe:django-s3file:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Codingjoe (789b8809-fc3f-5d69-97d2-cd9210a6f2dc) |
|---|---|
| Product | Django S3File (17ff1b50-98e2-5ebd-8998-73bbabbd6489) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-42196 |
vulnerable | 2026-06-08 08:03:16.011324 |
django-s3file: Relative path traversal
django-s3file is a lightweight file upload input for Django and Amazon S3. Prior to 7.0.2, S3FileMiddleware is vulnerable to relative path traversal attacks, where an attacker can use a modified request to escape pre-signed upload locations and have the Django application load files from random locations into request.FILES. Depending on how files are handled, this may lead to confidentiality and integrity issues. This vulnerability is fixed in 7.0.2.
Published: 2026-05-12T20:58:02.872Z
Updated: 2026-05-13T15:37:19.945Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-24840 |
vulnerable | 2026-06-08 05:41:44.738513 |
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in django-s3file
CRITICAL (9.1)
django-s3file is a lightweight file upload input for Django and Amazon S3 . In versions prior to 5.5.1 it was possible to traverse the entire AWS S3 bucket and in most cases to access or delete files. If the `AWS_LOCATION` setting was set, traversal was limited to that location only. The issue was discovered by the maintainer. There were no reports of the vulnerability being known to or exploited by a third party, prior to the release of the patch. The vulnerability has been fixed in version 5.5.1 and above. There is no feasible workaround. We must urge all users to immediately updated to a patched version.
Published: 2022-06-06T19:10:11.000Z
Updated: 2025-04-22T17:54:56.216Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.