django-s3file is vulnerable to relative path traversal

django-s3file (pip)

S3FileMiddleware is vulnerable to relative path traversal attacks, where an attacker can use a modified request to escape pre-signed upload locations and have the Django application load files from random locations into request.FILES Depending on how files are handled, this may lead to confidentiality and integrity issues.

Fix it

pip install --upgrade "django-s3file>=7.0.2"

First seen: 5 May 2026
Last update: 5 May 2026, 20:05 UTC
Fixed in: django-s3file 7.0.2
Identifiers: CVE-2026-42196
Source: GitHub advisory
On the menu as: PyPI packages
Python

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## django-s3file is vulnerable to relative path traversal
Severity: critical. Patch status: patched.
Affected: django-s3file (pip)
Fixed in: django-s3file 7.0.2
Ids: CVE-2026-42196

S3FileMiddleware is vulnerable to relative path traversal attacks, where an attacker can use a modified request to escape pre-signed upload locations and have the Django application load files from random locations into request.FILES Depending on how files are handled, this may lead to confidentiality and integrity issues.

## Steps
1. Search the repo, its CI and infra config for django-s3file (pip). If present, report the version in use and whether it's affected.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-42196") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://github.com/advisories/GHSA-67qg-7284-2277 https://github.com/codingjoe/django-s3file/security/advisories/GHSA-67qg-7284-2277 https://github.com/pypa/advisory-database/tree/main/vulns/django-s3file/PYSEC-2026-328.yaml https://nvd.nist.gov/vuln/detail/CVE-2026-42196 https://pypi.org/project/django-s3file
https://pwned.coffee/i/django-s3file-is-vulnerable-to-relative-path-traversal-cve-2026-42196

Sources

Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.

Totalone very hot coffee