CVE-2022-24840: Path Traversal in django-s3file
Summary
CVE-2022-24840: Path Traversal in django-s3file. Affects django-s3file versions < 5.5.1. Fixed in 5.5.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
django-s3file is a Python package available on PyPI that provides functionality for handling files stored in AWS S3 buckets within Django applications. It allows users to upload, retrieve, and manage files stored in S3. However, a vulnerability has been discovered in versions prior to 5.5.1 that allows for path traversal attacks, potentially leading to unauthorized access or deletion of files within the S3 bucket.
Vulnerability Detail
The path traversal vulnerability in django-s3file allows an attacker to traverse the entire AWS S3 bucket and perform destructive operations. By injecting malicious form data, an attacker can manipulate the file handling views and access or delete files within the bucket. The impact of this vulnerability can be significant, as it can lead to unauthorized access to sensitive files, deletion of important assets, or even code injection and remote code execution.
How To Fix
Latest published version: 7.2.0 as of 22 Oct 2026
pip install --upgrade "django-s3file==7.2.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.5.1
This is the first release that contains the fix.
pip install --upgrade "django-s3file==5.5.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no feasible workaround for this vulnerability. It is highly recommended to update to the patched version of django-s3file as soon as possible.
Conclusion
The path traversal vulnerability in django-s3file can have severe consequences, allowing unauthorized access, deletion of files, and even code injection. It is essential for users to update to version 5.5.1 or above to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django-s3file →
FAQ
The vulnerability allows an attacker to traverse the entire AWS S3 bucket and potentially access or delete files. It can also lead to code injection and remote code execution.
Yes, all versions prior to 5.5.1 are affected by this vulnerability. It is important to update to the patched version to mitigate the risk.
If all file handling views require authentication or special permission, the attack is limited to privileged users. However, if authentication is not enforced, any user can potentially exploit the vulnerability.
Yes, this vulnerability can be exploited remotely by sending a malicious request with manipulated form data.
There have been no reports of this vulnerability being known to or exploited by a third party before the release of the patch. However, it is crucial to update to the patched version to prevent any potential exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for django-s3file.
