AIKIDO-2025-10776

TL;DR

In version 5.0.0, the package changes its configuration system for backup storage, dropping support for DBBACKUP_STORAGE and DBBACKUP_STORAGE_OPTIONS in favor of Django’s STORAGES['dbbackup'] setting. However, if users do not explicitly define STORAGES['dbbackup'], the system defaults to using Django’s media directory (MEDIA_ROOT) as the backup location. This default behavior introduces a serious security vulnerability, as it can expose database backups — potentially containing sensitive user data — in a publicly accessible directory. The issue highlights the risk of insecure default configurations, where failing to define a new setting silently leads to unsafe behavior instead of triggering an explicit error. The fixed version will raise an error if the STORAGES['dbbackup'] setting is not defined, preventing the exposure of sensitive data.