GHSA-pcjh-6r5h-r92r
django-sendfile2 before 0.7.0 contains reflected file download vulnerability
GHSA-pcjh-6r5h-r92r is a vulnerability with no CVSS score yet in django-sendfile2, published August 11, 2022. No source lists public exploit code. Fixed in django-sendfile2 0.7.0.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.7.0django-sendfile2 +1 more
Description
Similar to CVE-2022-36359 for Django, django-sendfile2 did not protect against a reflected file download attack in version 0.6.1 and earlier. If the file name used by django-sendfile2 was derived from user input, then it would be possible to perform a such an attack. A new version of django-sendfile2 will be released. Either download django-sendfile2 0.7.0 as a workaround or sanitize user input yourself, using Django's patch as a template: https://github.com/django/django/commit/bd062445cffd3f6cc6dcd20d13e2abed818fa173
Affected packages
| Package | Affected | Fixed |
|---|---|---|
django-sendfile2PyPI | before 0.7.0 | 0.7.0 |
django-sendfile2PyPI | before 0.7.0, plus listed versions 0.4.00.4.10.4.20.4.30.5.10.6.00.6.1 | 0.7.0 |
What each source reports
GitHub AdvisoriesNo score
django-sendfile2 before 0.7.0 contains reflected file download vulnerability
Similar to CVE-2022-36359 for Django, django-sendfile2 did not protect against a reflected file download attack in version 0.6.1 and earlier. If the file name used by django-sendfile2 was derived from user input, then it would be possible to perform a such an attack. A new version of django-sendfile2 will be released. Either download django-sendfile2 0.7.0 as a workaround or sanitize user input yourself, using Django's patch as a template: https://github.com/django/django/commit/bd062445cffd3f6cc6dcd20d13e2abed818fa173
- Record
GHSA-pcjh-6r5h-r92r- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVNo score
django-sendfile2 before 0.7.0 contains reflected file download vulnerability
Similar to CVE-2022-36359 for Django, django-sendfile2 did not protect against a reflected file download attack in version 0.6.1 and earlier. If the file name used by django-sendfile2 was derived from user input, then it would be possible to perform a such an attack. A new version of django-sendfile2 will be released. Either download django-sendfile2 0.7.0 as a workaround or sanitize user input yourself, using Django's patch as a template: https://github.com/django/django/commit/bd062445cffd3f6cc6dcd20d13e2abed818fa173
- Record
GHSA-pcjh-6r5h-r92r- Weakness
- CWE-20
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.