{"id":"CVE-2026-27641","kind":"vulnerability","aliases":["CVE-2026-27641","GHSA-65mp-fq8v-56jr"],"related":[],"title":"Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection","description":"### Impact\nA critical path traversal and extension bypass vulnerability in Flask-Reuploaded allows remote attackers to achieve arbitrary file write and remote code execution through Server-Side Template Injection (SSTI).\n\n### Patches\nFlask-Reuploaded has been patched in version 1.5.0\n\n### Workarounds\n\n1. **Do not pass user input to the `name` parameter**\n2. Use auto-generated filenames only\n3. Implement strict input validation if `name` must be used\n\n```python\nfrom werkzeug.utils import secure_filename\nimport os\n\n# Sanitize user input before passing to save()\nsafe_name = secure_filename(request.form.get('custom_name'))\n# Remove path separators\nsafe_name = os.path.basename(safe_name)\n# Validate extension matches policy\nif not photos.extension_allowed(photos.get_extension(safe_name)):\n    abort(400)\n    \nfilename = photos.save(file, name=safe_name)\n```\n\n### Resources\nThe fix is documented in the pull request, see https://github.com/jugmac00/flask-reuploaded/pull/180.\n\nA proper write-up was created by the reporter of the vulnerability, Jaron Cabral (https://www.linkedin.com/in/jaron-cabral-751994357/), but is not yet available as of time of this publication.","summary":"Flask-Reuploaded, a Python library for handling file uploads in Flask apps, lets a user-supplied name parameter write files outside the upload folder and bypass extension checks. The advisory says an attacker can use this arbitrary file write, through server-side template injection, to execute code on the server.","severity":"critical","cvss":9.8,"epss":0.01337,"exploited":false,"exploited_at":null,"products":[{"name":"flask-reuploaded","fixed":["1.5.0"],"affected":"< 1.5.0","ecosystem":"pypi"},{"name":"jugmac00 flask-reuploaded","fixed":["1.5.0"],"affected":"< 1.5.0","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["cwe-1336","cwe-22","flask","flask-reuploaded","package","python","self-hosted"],"not_affected_if":["auto-generated-filenames","not-using-flask-reuploaded"],"how_to_check":"- Run `pip show flask-reuploaded` and compare the version against `1.5.0`.\n- Search your code for calls to `photos.save(` or other Flask-Reuploaded save calls where the `name` argument comes from request data.","fix":"- Upgrade `flask-reuploaded` to `1.5.0` or later.\n- Until upgraded, stop passing user input to the `name` parameter, or sanitize it with `secure_filename` and `os.path.basename` and check the extension against your policy.","status":"open","published_at":"2026-02-25T04:16:04+00:00","first_seen_at":"2026-10-27T16:41:05+00:00","triaged_at":"2026-10-27T16:42:06+00:00","updated_at":"2026-10-27T17:03:04+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-27T16:42:06Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `flask-reuploaded` to `1.5.0` or later.\n- Until upgraded, stop passing user input to the `name` parameter, or sanitize it with `secure_filename` and `os.path.basename` and check the extension against your policy.","reach":"internet","title":"Flask-Reuploaded: path traversal in upload name lets remote users run code","impact":"high","summary":"Flask-Reuploaded, a Python library for handling file uploads in Flask apps, lets a user-supplied name parameter write files outside the upload folder and bypass extension checks. The advisory says an attacker can use this arbitrary file write, through server-side template injection, to execute code on the server.","category":"package","nicknames":[],"who_cares":["python","flask","flask-reuploaded","self-hosted"],"confidence":0.7,"needs_auth":"unknown","worst_case":"remote attacker writes files and runs code on the server","analyst_note":"Confirm the exact upload route and whether authentication is required, using the GHSA page at https://github.com/advisories/GHSA-65mp-fq8v-56jr and PR https://github.com/jugmac00/flask-reuploaded/pull/180.","how_to_check":"- Run `pip show flask-reuploaded` and compare the version against `1.5.0`.\n- Search your code for calls to `photos.save(` or other Flask-Reuploaded save calls where the `name` argument comes from request data.","needs_analyst":true,"not_affected_if":["auto-generated-filenames","not-using-flask-reuploaded"],"who_is_affected":"Applications that use Flask-Reuploaded below 1.5.0 and pass a user-controlled value into the save name are exposed. The advisory's workarounds point to the save call's name argument as the risky path, and apps that only use auto-generated filenames are not described as affected. Teams not using this library can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000711,"input_tokens":3714,"output_tokens":680,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-1336':34B '-2026':16A,24A '-22':36B '-27641':17A,25A '/in/jaron-cabral-751994357/),':249C '/jugmac00/flask-reuploaded/pull/180.':231C '1':142C '1.5.0':140C '2':152C '3':159C '400':212C '56jr':22A '65mp':20A 'abort':211C 'achiev':116C 'advisori':77B 'allow':112C,206C 'app':58B 'arbitrari':84B,117C 'attack':80B,114C 'auto':155C 'auto-gener':154C 'avail':254C 'bypass':73B,106C 'cabral':246C 'check':75B 'code':7A,95B,122C 'creat':238C 'critic':101C 'custom':189C 'cve':15A,23A 'cwe':33B,35B 'document':223C 'execut':8A,94B,123C 'extens':74B,105C,200C,208C 'file':54B,67B,85B,118C,215C 'filenam':157C,174C,187C,213C 'fix':221C 'flask':2A,27A,31A,37B,39B,47B,57B,110C,133C 'flask-reupload':1A,38B,46B,109C,132C 'flask-reuploaded':26A,30A 'folder':71B 'fq8v':21A 'generat':156C 'ghsa':19A 'ghsa-65mp-fq8v-56jr':18A 'github.com':230C 'github.com/jugmac00/flask-reuploaded/pull/180.':229C 'handl':53B 'host':45B 'impact':99C 'implement':160C 'import':172C,175C 'inject':14A,92B,129C 'input':147C,162C,179C 'jaron':245C 'jugmac00':29A 'let':59B 'librari':51B 'match':201C 'must':166C 'name':64B,150C,165C,185C,190C,195C,198C,210C,216C,218C 'os':176C 'os.path.basename':196C 'outsid':68B 'packag':41B 'paramet':65B,151C 'pass':145C,181C 'patch':131C,137C 'path':102C,192C 'photos.extension':205C 'photos.get':207C 'photos.save':214C 'polici':202C 'proper':233C 'public':260C 'pull':226C 'python':42B,50B,169C 'remot':6A,113C,121C 'remov':191C 'report':241C 'request':227C 'request.form.get':188C 'resourc':219C 'reupload':3A,40B,48B,111C,134C 'reuploaded':28A,32A 'safe':184C,194C,197C,209C,217C 'sanit':177C 'save':183C 'say':78B 'secur':173C,186C 'see':228C 'self':44B 'self-host':43B 'separ':193C 'server':11A,89B,98B,126C 'server-sid':10A,88B,125C 'side':12A,90B,127C 'ssti':130C 'strict':161C 'suppli':63B 'templat':13A,91B,128C 'time':257C 'travers':103C 'upload':55B,70B 'use':82B,153C,168C 'user':62B,146C,178C 'user-suppli':61B 'valid':163C,199C 'version':139C 'via':9A 'vulner':4A,107C,244C 'werkzeug.utils':171C 'workaround':141C 'write':66B,86B,119C,235C 'write-up':234C 'www.linkedin.com':248C 'www.linkedin.com/in/jaron-cabral-751994357/),':247C 'yet':253C","nicknames":[],"mitigations":[],"who_affected":"Applications that use Flask-Reuploaded below 1.5.0 and pass a user-controlled value into the save name are exposed. The advisory's workarounds point to the save call's name argument as the risky path, and apps that only use auto-generated filenames are not described as affected. Teams not using this library can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-02-25T04:16:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-65mp-fq8v-56jr","url":"https://github.com/advisories/GHSA-65mp-fq8v-56jr","severity":"critical","published_at":"2026-02-25T19:06:50+00:00","modified_at":"2026-10-27T16:38:55+00:00","first_seen_at":"2026-10-27T16:41:05+00:00","fetched_at":"2026-10-27T16:41:05+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-27641","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27641","severity":null,"published_at":"2026-02-25T04:16:04+00:00","modified_at":"2026-06-17T10:27:26+00:00","first_seen_at":"2026-10-27T17:03:04+00:00","fetched_at":"2026-10-27T17:03:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}