Live › vulnerability › CVE-2026-27641
Go to dashboardFlask-Reuploaded, a Python library for handling file uploads in Flask apps, lets a user-supplied name parameter write files outside the upload folder and bypass extension checks. The advisory says an attacker can use this arbitrary file write, through server-side template injection, to execute code on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 16:41 UTC, 0h before NVD. All times on this page are UTC.
Applications that use Flask-Reuploaded below 1.5.0 and pass a user-controlled value into the save name are exposed. The advisory's workarounds point to the save call's name argument as the risky path, and apps that only use auto-generated filenames are not described as affected. Teams not using this library can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| flask-reuploaded | pypi | < 1.5.0 | 1.5.0 |
| jugmac00 flask-reuploaded | vendor | < 1.5.0 | 1.5.0 |
pip show flask-reuploaded and compare the version against 1.5.0.photos.save( or other Flask-Reuploaded save calls where the name argument comes from request data.flask-reuploaded to 1.5.0 or later.name parameter, or sanitize it with secure_filename and os.path.basename and check the extension against your policy.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A critical path traversal and extension bypass vulnerability in Flask-Reuploaded allows remote attackers to achieve arbitrary file write and remote code execution through Server-Side Template Injection (SSTI).
Flask-Reuploaded has been patched in version 1.5.0
name parametername must be usedfrom werkzeug.utils import secure_filename
import os
# Sanitize user input before passing to save()
safe_name = secure_filename(request.form.get('custom_name'))
# Remove path separators
safe_name = os.path.basename(safe_name)
# Validate extension matches policy
if not photos.extension_allowed(photos.get_extension(safe_name)):
abort(400)
filename = photos.save(file, name=safe_name)
The fix is documented in the pull request, see https://github.com/jugmac00/flask-reuploaded/pull/180.
A proper write-up was created by the reporter of the vulnerability, Jaron Cabral (https://www.linkedin.com/in/jaron-cabral-751994357/), but is not yet available as of time of this publication.
This page as .md · .json · in your agent: get_signal("CVE-2026-27641")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.