Executive brief
django-s3file is a software component used by web applications to handle file uploads directly to Amazon S3 storage. A security flaw in this component allows an attacker to bypass intended upload restrictions by manipulating file paths in their requests. This could allow an unauthorized user to force the application to process or overwrite files in unintended locations, potentially leading to the theft of sensitive data or the corruption of application files.
Technical details
A relative path traversal vulnerability exists in the S3FileMiddleware component of django-s3file prior to version 7.0.2. The root cause is improper neutralization of path sequences (e.g., '../') in user-supplied input used to construct file paths for Amazon S3 uploads. A remote, unauthenticated attacker can exploit this by sending a specially crafted HTTP request to escape the designated pre-signed upload directory. This allows the attacker to force the Django application to load files from arbitrary S3 locations into the request.FILES object, potentially leading to unauthorized data access or integrity compromise depending on how the application subsequently processes those files. The issue is resolved in version 7.0.2.
Affected products
- codingjoe django-s3file < 7.0.2
Timeline
- 2026-04-28: advisory: Vendor advisory published on GitHub
- 2026-05-12: disclosed: CVE published to NVD