Skip to content
OpenAdvisories

Package · PyPI

django-sendfile2

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High —
    GHSA-pcjh-6r5h-r92r

    django-sendfile2 before 0.7.0 contains reflected file download vulnerability

    Similar to CVE-2022-36359 for Django, django-sendfile2 did not protect against a reflected file download attack in version 0.6.1 and earlier. If the file name used by django-sendfile2 was derived from user input, then it would be possible to perform a such an…

    django-sendfile2 PyPI
  • Medium —
    GHSA-6r3c-8xf3-ggrr

    Directory traversal outside of SENDFILE_ROOT in django-sendfile2

    django-sendfile2 currently relies on the backend to correctly limit file paths to `SENDFILE_ROOT`. This is not the case for the `simple` and `development` backends, it is also not necessarily the case for any of the other backends either (it's just an assumpt…

    django-sendfile2 PyPI