---
id: "CVE-2026-27641"
kind: "vulnerability"
aliases: ["CVE-2026-27641", "GHSA-65mp-fq8v-56jr"]
title: "Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection"
severity: "critical"
cvss: 9.8
epss: 0.01337
exploited: false
status: "open"
category: "package"
products: [{"name": "flask-reuploaded", "fixed": ["1.5.0"], "affected": "< 1.5.0", "ecosystem": "pypi"}, {"name": "jugmac00 flask-reuploaded", "fixed": ["1.5.0"], "affected": "< 1.5.0", "ecosystem": "vendor"}]
ecosystems: ["pypi", "vendor"]
tags: ["cwe-1336", "cwe-22", "flask", "flask-reuploaded", "package", "python", "self-hosted"]
not_affected_if: ["auto-generated-filenames", "not-using-flask-reuploaded"]
published_at: "2026-02-25T04:16:04+00:00"
first_seen_at: "2026-10-27T16:41:05+00:00"
updated_at: "2026-10-27T17:03:04+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-65mp-fq8v-56jr", "first_seen_at": "2026-10-27T16:41:05+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27641", "first_seen_at": "2026-10-27T17:03:04+00:00"}]
---

# Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection

Flask-Reuploaded, a Python library for handling file uploads in Flask apps, lets a user-supplied name parameter write files outside the upload folder and bypass extension checks. The advisory says an attacker can use this arbitrary file write, through server-side template injection, to execute code on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:flask-reuploaded affected < 1.5.0 fixed 1.5.0
- vendor:jugmac00 flask-reuploaded affected < 1.5.0 fixed 1.5.0

## How to check

- Run `pip show flask-reuploaded` and compare the version against `1.5.0`.
- Search your code for calls to `photos.save(` or other Flask-Reuploaded save calls where the `name` argument comes from request data.

## Fix

- Upgrade `flask-reuploaded` to `1.5.0` or later.
- Until upgraded, stop passing user input to the `name` parameter, or sanitize it with `secure_filename` and `os.path.basename` and check the extension against your policy.

## Timeline

- 2026-10-27T16:41:05+00:00 ghsa https://github.com/advisories/GHSA-65mp-fq8v-56jr
- 2026-10-27T17:03:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-27641

## From the sources

### Impact
A critical path traversal and extension bypass vulnerability in Flask-Reuploaded allows remote attackers to achieve arbitrary file write and remote code execution through Server-Side Template Injection (SSTI).

### Patches
Flask-Reuploaded has been patched in version 1.5.0

### Workarounds

1. **Do not pass user input to the `name` parameter**
2. Use auto-generated filenames only
3. Implement strict input validation if `name` must be used

```python
from werkzeug.utils import secure_filename
import os

# Sanitize user input before passing to save()
safe_name = secure_filename(request.form.get('custom_name'))
# Remove path separators
safe_name = os.path.basename(safe_name)
# Validate extension matches policy
if not photos.extension_allowed(photos.get_extension(safe_name)):
    abort(400)
    
filename = photos.save(file, name=safe_name)
```

### Resources
The fix is documented in the pull request, see https://github.com/jugmac00/flask-reuploaded/pull/180.

A proper write-up was created by the reporter of the vulnerability, Jaron Cabral (https://www.linkedin.com/in/jaron-cabral-751994357/), but is not yet available as of time of this publication.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_