django-s3file Relative Path Traversal Vulnerability in S3FileMiddleware

A relative path traversal vulnerability has been identified in the S3FileMiddleware component of django-s3file, a file upload input tool for Django and Amazon S3. This vulnerability exists in versions of django-s3file through 7.0.1. It allows attackers to manipulate requests to escape pre-signed upload locations, causing the Django application to load files from arbitrary locations into request.FILES. Depending on the application's file handling procedures, this could result in confidentiality and integrity issues.

Impact

Exploitation of this vulnerability allows for relative path traversal, enabling attackers to load files from arbitrary locations into request.FILES. This could lead to significant confidentiality and integrity issues, depending on how the uploaded files are processed by the application.

Remediation

Users are advised to update to django-s3file version 7.0.2 or later.