Scrapy versions from 2.9.0 up to but not including 2.11.2 improperly followed redirects for URL schemes beyond HTTP and HTTPS, such as file://, ftp://, and s3://. This behavior could allow an attacker with the ability to control start requests and read spider output to access local files or sensitive credentials via redirected URLs. The vulnerability is fixed in Scrapy 2.11.2.