CVE-2026-42196: django-s3file Path Traversal in S3FileMiddleware
CVE-2026-42196 is a path traversal weakness (CWE-22) in S3FileMiddleware of django-s3file, a file upload library for Django and Amazon S3, in versions prior to 7.0.2. The GitHub CNA rated it 9.9 critical under CVSS v4.0, and the record states the issue is fixed in 7.0.2. No confirmed exploitation appears in the sources consulted, and the record does not show a CISA KEV listing.
Overview
CVE-2026-42196 affects django-s3file, a library that handles file uploads for Django applications using Amazon S3. According to the record, S3FileMiddleware in versions before 7.0.2 can be led by a modified request to escape pre-signed upload locations, so the application loads files from unintended locations into request.FILES.
Impact
The record states that, depending on how uploaded files are handled, this may lead to confidentiality and integrity issues. The GitHub CNA rated the CVE 9.9 critical under CVSS v4.0, and the vector shows high confidentiality and integrity impact with no availability impact. The record does not describe which data could be exposed.
Affected products and versions
- Product: django-s3file
- Affected: versions prior to 7.0.2, according to the description
- Fixed: 7.0.2, according to the description
- The structured affected and fixes fields in the record are empty, so version information comes from the narrative text only.
Exploitation status
CISA KEV does not list this CVE in the record. No confirmed active exploitation or exploitation in the wild appears in the sources consulted.
Remediation and mitigation
- Upgrade django-s3file to version 7.0.2 or later, as stated in the record.
- Check whether your Django applications use S3FileMiddleware and include the update in your normal change process.
- Until an upgrade is possible, review how your application handles uploads and restrict who can reach upload endpoints, based on your own risk assessment. Further mitigation details are not in the record.
Detection guidance
- Review web and application logs for upload requests containing unusual path-like values or unexpected file references.
- Monitor for unexpected files appearing in the request handling or storage locations used by your upload workflow.
- Correlate these signals with your inventory of django-s3file versions.
Limitations of the available information
The record has no structured affected version ranges and no details on exploitability beyond the description. The source status is Deferred without a stated reason. EPSS values are as recorded: probability 0.0059 and percentile 0.46785. Whether versions other than those described are affected is unknown. Consult the GitHub advisory for authoritative details.
Frequently asked questions
Which versions of django-s3file are affected by CVE-2026-42196?
According to the record description, versions prior to 7.0.2 are affected. The structured affected-version fields in the record are empty, so confirm against the GitHub advisory.
Is CVE-2026-42196 being actively exploited?
The record does not list this CVE in CISA KEV, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.