The django-s3file package contains a critical vulnerability (CVE-2026-42196) in its S3FileMiddleware component that allows relative path traversal attacks. An attacker can manipulate requests to escape intended pre-signed upload directories and cause the Django application to load files from arbitrary locations into request.FILES. This can lead to confidentiality and integrity breaches depending on file handling. A patch is available in version 7.0.2 and users are urged to update.