django-s3file is a lightweight file‑upload component for Django that relies on Amazon S3. Prior to version 7.0.2, the S3FileMiddleware processes upload requests without validating the destination file path. An attacker can craft a request that manipulates a pre‑signed S3 upload URL, causing the middleware to load a file from an arbitrary filesystem location into request.FILES. This relative path traversal flaw is a classic example of CWE‑22 and CWE‑26. As a result, sensitive files can be read and application logic may inadvertently expose or modify data, leading to confidentiality and integrity problems.

The issue affects the codingjoe django‑s3file package. All releases older than 7.0.2 are vulnerable. Organizations that have installed any earlier version of this package are exposed until the update is applied.

The CVSS score of 9.9 marks it as critical. The EPSS score is not available, so the current exploitation probability cannot be quantified, but the vulnerability is widely exploitable through normal HTTP traffic. It is not listed in CISA KEV, indicating no known public exploit at this time. However, an attacker only needs to send a crafted upload request, making the attack vector easy to construct and the impact severe. Prompt remediation is essential.