Live › vulnerability › GHSA-6r3c-8xf3-ggrr
Go to dashboarddjango-sendfile2 does not enforce that requested file paths stay inside SENDFILE_ROOT in the simple and development backends, and other backends may not either. An attacker who can request files through an affected view can read files outside the intended directory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 06:33 UTC. All times on this page are UTC.
Django projects that use django-sendfile2 to serve files based on a user-supplied or otherwise attacker-influenced path. The simple and development backends are called out as not limiting paths to SENDFILE_ROOT, and the advisory says other backends may not either. Projects that only serve fixed files or do not use django-sendfile2 can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| django-sendfile2 | pypi | < 0.6.0 | 0.6.0 |
pip show django-sendfile2 and confirm the version is below 0.6.0SENDFILE_BACKEND to sendfile2.backends.simple or development, or uses another backendSENDFILE_ROOT is set in the settings module0.6.0 or laterSENDFILE_ROOT in the settings module if it is not already setEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
django-sendfile2 currently relies on the backend to correctly limit file paths to SENDFILE_ROOT. This is not the case for the simple and development backends, it is also not necessarily the case for any of the other backends either (it's just an assumption that was made by the original author).
This will be fixed in 0.6.0 which is to be released the same day as this advisory is made public.
When upgrading, you will need to make sure SENDFILE_ROOT is set in your settings module if it wasn't already.
This page as .md · .json · in your agent: get_signal("GHSA-6r3c-8xf3-ggrr")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.