-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper input validation in the 'sendfile' function when handling user-supplied filenames. The patch in utils.py adds critical escaping of backslashes (replace('\', '\\')) and quotes (replace('"', r'"')), directly addressing CWE-20. The added test cases in tests.py validate that filenames with injection attempts are now properly escaped. Since the vulnerability manifests when user input flows into the 'attachment_filename' parameter without proper sanitization, and the patch specifically modifies this code path, we can conclusively identify the 'sendfile' function as the vulnerable component.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| django-sendfile2 | pip | < 0.7.0 | 0.7.0 |