{"id":"GHSA-pcjh-6r5h-r92r","aliases":[],"status":"published","title":"django-sendfile2 before 0.7.0 contains reflected file download vulnerability","description":"Similar to CVE-2022-36359 for Django, django-sendfile2 did not protect against a reflected file download attack in version 0.6.1 and earlier. If the file name used by django-sendfile2 was derived from user input, then it would be possible to perform a such an attack. A new version of django-sendfile2 will be released. Either download django-sendfile2 0.7.0 as a workaround or sanitize user input yourself, using Django's patch as a template: https://github.com/django/django/commit/bd062445cffd3f6cc6dcd20d13e2abed818fa173","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2022-08-11T18:12:35Z","modified":"2026-10-24T06:30:30Z","fixes":[{"ecosystem":"PyPI","package":"django-sendfile2","fixed_in":["0.7.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"django-sendfile2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"django-sendfile2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0"}]}],"versions":["0.4.0","0.4.1","0.4.2","0.4.3","0.5.1","0.6.0","0.6.1"]}],"references":[{"url":"https://github.com/moggers87/django-sendfile2/security/advisories/GHSA-pcjh-6r5h-r92r","tags":["web"]},{"url":"https://github.com/moggers87/django-sendfile2/commit/4c370859023292e3715200a57843f86c5ef3cd77","tags":["web"]},{"url":"https://github.com/moggers87/django-sendfile2/releases/tag/v0.7.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-pcjh-6r5h-r92r"},{"url":"https://github.com/moggers87/django-sendfile2","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-pcjh-6r5h-r92r","title":"django-sendfile2 before 0.7.0 contains reflected file download vulnerability","description":"Similar to CVE-2022-36359 for Django, django-sendfile2 did not protect against a reflected file download attack in version 0.6.1 and earlier. If the file name used by django-sendfile2 was derived from user input, then it would be possible to perform a such an attack. A new version of django-sendfile2 will be released. Either download django-sendfile2 0.7.0 as a workaround or sanitize user input yourself, using Django's patch as a template: https://github.com/django/django/commit/bd062445cffd3f6cc6dcd20d13e2abed818fa173","status":"published","published":"2022-08-11T18:12:35Z","modified":"2026-10-24T06:30:30Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:41:36.858527Z"}],"osv":[{"id":"GHSA-pcjh-6r5h-r92r","title":"django-sendfile2 before 0.7.0 contains reflected file download vulnerability","description":"Similar to CVE-2022-36359 for Django, django-sendfile2 did not protect against a reflected file download attack in version 0.6.1 and earlier. If the file name used by django-sendfile2 was derived from user input, then it would be possible to perform a such an attack. A new version of django-sendfile2 will be released. Either download django-sendfile2 0.7.0 as a workaround or sanitize user input yourself, using Django's patch as a template: https://github.com/django/django/commit/bd062445cffd3f6cc6dcd20d13e2abed818fa173","status":"published","published":"2022-08-11T18:12:35Z","modified":"2024-12-03T06:06:56.847569Z","cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:52.891208Z"}]}}