Live › vulnerability › GHSA-pcjh-6r5h-r92r
Go to dashboarddjango-sendfile2 up to 0.6.1 does not protect against reflected file downloads, so a file name taken from user input can be served with an attacker-chosen name. An attacker can craft a link that makes a victim's browser download a file the server returns under a name the attacker controls.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 06:33 UTC. All times on this page are UTC.
Applications that use django-sendfile2 to serve files whose names are derived from user input are exposed. Projects that only serve fixed, server-chosen file names, or that do not use django-sendfile2, can skip this.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| django-sendfile2 | pypi | < 0.7.0 | 0.7.0 |
pip show django-sendfile2 and confirm the installed version is below 0.7.0.0.7.0.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Similar to CVE-2022-36359 for Django, django-sendfile2 did not protect against a reflected file download attack in version 0.6.1 and earlier. If the file name used by django-sendfile2 was derived from user input, then it would be possible to perform a such an attack. A new version of django-sendfile2 will be released. Either download django-sendfile2 0.7.0 as a workaround or sanitize user input yourself, using Django's patch as a template: https://github.com/django/django/commit/bd062445cffd3f6cc6dcd20d13e2abed818fa173
This page as .md · .json · in your agent: get_signal("GHSA-pcjh-6r5h-r92r")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.