Description

An Improper Input Validation vulnerability (CWE-20) in Archmonger ServeStatic allows remote unauthenticated attackers to cause an unhandled ValueError (500 crash) by sending a request path containing an embedded NUL byte that survives path normalization. In deployments where DEBUG=True or autorefresh is enabled, this unhandled exception crashes request handling and renders Django's technical debug page, exposing system file paths, installed apps, and environment configuration.

CVSS Vector

Primary assessmentGitHub Advisory · 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
AV: NetworkAC: LowPR: NoneUI: NoneS: UnchangedC: NoneI: NoneA: Low

Disclosure Status

Affected
< 4.3.4 (verified against v4.3.3 / commit ea6828f)
Patch status
Fixed in >= 4.3.4
Vendor response
Upstream patch released in Archmonger/ServeStatic >= 4.3.4 via advisory GHSA-q353-2cxp-ppfh
Primary score source
GitHub Advisory

References

Record Verification

CreditFound and reported by Sevban DÖNMEZ
PublishedThe CVE ID is assigned; the CVE.org record has not been published yet
CheckedUpstream fix and references last checked on 2026-09-17

Disclosure Timeline

2026-09-17Security advisory — Security advisory GHSA-q353-2cxp-ppfh published on GitHub and CVE-2026-91117 assigned. Source ↗