Cleartext transmission of sensitive information in scrapy - #VU162974
Published: November 9, 2026
Vulnerability identifier: #VU162974
CSH Severity: Medium
CVSS v4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-319
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated network attacker to read uploaded files and authentication metadata and falsify storage results.
The vulnerability exists due to plaintext HTTP requests from Scrapy's files and images pipelines when FILES_STORE or IMAGES_STORE targets S3 without explicitly enabling HTTPS. An unauthenticated network attacker can intercept this traffic to inspect uploads or forge responses that cause files to be skipped or falsely reported as stored.
Affected software
scrapy
Remediation
Install security update from vendor's website.
scrapy - update to 2.20.0