Scrapy versions >=2.9.0 and <2.11.2 allowed redirect following for protocols other than HTTP and HTTPS, including data://, file://, ftp://, and s3://, due to the way the RedirectMiddleware and MetaRefreshMiddleware handled redirects. This could be exploited by an attacker with write access to start requests and read access to spider output to redirect to local files (file://), malicious FTP servers (ftp://), or S3 buckets (s3://) to access sensitive data or credentials configured in the spider or project. The extent of data exposure depends on how the spider processes response data. The issue is resolved by upgrading to Scrapy 2.11.2 or implementing custom middleware that enforces proper redirect scheme restrictions.

An attacker with the ability to define start URLs and read spider output can exploit this vulnerability to access local files, FTP credentials, or S3 data by redirecting to non-HTTP(S) schemes. This can lead to unauthorized disclosure of sensitive information configured in the spider or project. The impact severity is medium with a CVSS score of 6.5, reflecting high confidentiality impact but no integrity or availability impact.

Upgrade Scrapy to version 2.11.2 or later, where this redirect handling issue is fixed. Alternatively, replace the built-in RedirectMiddleware and MetaRefreshMiddleware with custom implementations that restrict redirects to HTTP and HTTPS schemes as per the fix in 2.11.2. Verify that custom middleware correctly enforces these restrictions.