WS-2020-0125

django-sendfile2 currently relies on the backend to correctly limit file paths to "SENDFILEROOT". This is not the case for the "simple" and "development" backends, it is also not necessarily the case for any of the other backends either it's just an assumption that was made by the original author...

GHSA-PCJH-6R5H-R92R django-sendfile2 before 0.7.0 contains reflected file download vulnerability

Similar to CVE-2022-36359 for Django, django-sendfile2 did not protect against a reflected file download attack in version 0.6.1 and earlier. If the file name used by django-sendfile2 was derived from user input, then it would be possible to perform a such an attack. A new version of...

django-sendfile2 before 0.7.0 contains reflected file download vulnerability

Similar to CVE-2022-36359 for Django, django-sendfile2 did not protect against a reflected file download attack in version 0.6.1 and earlier. If the file name used by django-sendfile2 was derived from user input, then it would be possible to perform a such an attack. A new version of...

PT-2020-21102

Name of the Vulnerable Software and Affected Versions django-sendfile2 versions prior to 0.6.0 Description The issue arises from django-sendfile2 relying on the backend to correctly limit file paths to SENDFILE ROOT, which is not guaranteed for the simple and development backends, and potentially...