---
id: "GHSA-6r3c-8xf3-ggrr"
kind: "vulnerability"
aliases: ["GHSA-6r3c-8xf3-ggrr"]
title: "Directory traversal outside of SENDFILE_ROOT in django-sendfile2"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "django-sendfile2", "fixed": ["0.6.0"], "affected": "< 0.6.0", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["cwe-22", "django", "package", "python", "self-hosted"]
not_affected_if: ["no-user-controlled-paths", "not-using-django-sendfile2"]
published_at: "2020-06-24T17:15:26+00:00"
first_seen_at: "2026-10-24T06:33:21+00:00"
updated_at: "2026-10-25T05:41:52+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-6r3c-8xf3-ggrr", "first_seen_at": "2026-10-24T06:33:21+00:00"}]
---

# Directory traversal outside of SENDFILE_ROOT in django-sendfile2

django-sendfile2 does not enforce that requested file paths stay inside SENDFILE_ROOT in the simple and development backends, and other backends may not either. An attacker who can request files through an affected view can read files outside the intended directory.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:django-sendfile2 affected < 0.6.0 fixed 0.6.0

## How to check

- Run `pip show django-sendfile2` and confirm the version is below `0.6.0`
- Check whether the project sets `SENDFILE_BACKEND` to `sendfile2.backends.simple` or `development`, or uses another backend
- Check whether `SENDFILE_ROOT` is set in the settings module

## Fix

- Upgrade django-sendfile2 to `0.6.0` or later
- Set `SENDFILE_ROOT` in the settings module if it is not already set

## Timeline

- 2026-10-24T06:33:21+00:00 ghsa https://github.com/advisories/GHSA-6r3c-8xf3-ggrr

## From the sources

django-sendfile2 currently relies on the backend to correctly limit file paths to `SENDFILE_ROOT`. This is not the case for the `simple` and `development` backends, it is also not necessarily the case for any of the other backends either (it's just an assumption that was made by the original author).

This will be fixed in 0.6.0 which is to be released the same day as this advisory is made public.

When upgrading, you will need to make sure `SENDFILE_ROOT` is set in your settings module if it wasn't already.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_