The django-s3file package, used for lightweight file uploads in Django applications with Amazon S3, had a path traversal vulnerability (CWE-22) in its S3FileMiddleware component before version 7.0.2. This vulnerability allowed attackers to craft requests that bypass pre-signed upload location restrictions, enabling the application to load files from unintended locations into request.FILES. Such unauthorized file access could compromise confidentiality and integrity of data processed by the application. The vulnerability has a CVSS 4.0 score of 9.9, indicating critical severity. The vendor has released version 7.0.2 to address this issue. Since django-s3file is a cloud service, the vendor typically manages patching server-side.

Successful exploitation allows attackers to perform path traversal to load arbitrary files into the Django application's request.FILES, potentially exposing sensitive data or corrupting application state. This impacts confidentiality and integrity of the affected system. The CVSS score of 9.9 reflects the high impact and ease of exploitation without privileges or user interaction.

A fix is available in django-s3file version 7.0.2. Users and administrators should upgrade to version 7.0.2 or later to remediate this vulnerability. Since django-s3file is a cloud-hosted service, the vendor manages remediation server-side; verify with the vendor advisory that the service is updated accordingly. No additional mitigation steps are indicated by the vendor.