CVE-2022-36359

An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a FileResponse when the filename is derived from user-supplied input.

• CWE-494

• http://www.openwall.com/lists/oss-security/2022/08/03/1Mailing List, Patch, Third Party Advisory
• https://docs.djangoproject.com/en/4.0/releases/security/Not Applicable, Patch, Vendor Advisory
• https://groups.google.com/g/django-announce/c/8cz--gvaJr4Release Notes, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/
• https://security.netapp.com/advisory/ntap-20220915-0008/Third Party Advisory
• https://www.debian.org/security/2022/dsa-5254Third Party Advisory
• https://www.djangoproject.com/weblog/2022/aug/03/security-releases/Patch, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2022/08/03/1Mailing List, Patch, Third Party Advisory
• https://docs.djangoproject.com/en/4.0/releases/security/Not Applicable, Patch, Vendor Advisory
• https://groups.google.com/g/django-announce/c/8cz--gvaJr4Release Notes, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/
• https://security.netapp.com/advisory/ntap-20220915-0008/Third Party Advisory
• https://www.debian.org/security/2022/dsa-5254Third Party Advisory
• https://www.djangoproject.com/weblog/2022/aug/03/security-releases/Patch, Vendor Advisory

Published

Aug 3, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-36353Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2022-36354A heap out-of-bounds read vulnerability exists in the RLA fo…5.3
• CVE-2022-36355Authenticated (contributor+) Stored Cross-Site Scripting (XS…5.4
• CVE-2022-36356Authenticated (admin+) Stored Cross-Site Scripting (XSS) vul…4.8
• CVE-2022-36357Unauth. Reflected Cross-Site Scripting (XSS) vulnerability i…6.1
• CVE-2022-36358Cross-Site Request Forgery (CSRF) vulnerability in SEO Scout…4.3
• CVE-2022-3636A vulnerability was identified in Linux Kernel 33fc42de33278…7.8
• CVE-2022-36360A vulnerability has been identified in LOGO! 8 BM (incl. SIP…7.5
• CVE-2022-36361A vulnerability has been identified in LOGO! 12/24RCE (6ED10…9.8
• CVE-2022-36362A vulnerability has been identified in LOGO! 12/24RCE (6ED10…7.5
• CVE-2022-36363A vulnerability has been identified in LOGO! 12/24RCE (6ED10…5.3
• CVE-2022-36364Apache Calcite Avatica JDBC driver creates HTTP client insta…8.8