Directory traversal outside of SENDFILE_ROOT in django-sendfile2

published 2020-06-24 6y ago modified 2024-12-02 last yr.

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

django-sendfile2 currently relies on the backend to correctly limit file paths to `SENDFILE_ROOT`. This is not the case for the `simple` and `development` backends, it is also not necessarily the case for any of the other backends either (it's just an assumption that was made by the original author).

This will be fixed in 0.6.0 which is to be released the same day as this advisory is made public.

When upgrading, you will need to make sure `SENDFILE_ROOT` is set in your settings module if it wasn't already.

Patch / fix

fixed in 1 links 1

pypi django-sendfile2 0.6.0

github.com/moggers87/django-sendfile2@f870c52 commit

Is GHSA-6r3c-8xf3-ggrr in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
pypi	django-sendfile2	<0.6.0	0.6.0

Classification

Weakness

CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

GitHub Advisory GHSA-6r3c-8xf3-ggrr

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.