Path Traversal and Extension Bypass Vulnerability in Flask-Reuploaded by Flask

CVE-2026-27641

What is CVE-2026-27641?

Flask-Reuploaded, a popular tool for handling file uploads in Flask applications, has a vulnerability that allows remote attackers to exploit arbitrary file writing and execute remote code. This issue arises from a path traversal and extension bypass flaw present in versions before 1.5.0. By leveraging Server-Side Template Injection (SSTI), attackers can manipulate the file upload functionality. Users are encouraged to upgrade to version 1.5.0 or later to mitigate this risk. For those unable to upgrade immediately, it's advisable to avoid passing user inputs directly to the 'name' parameter, use automatically generated filenames and enforce strict input validation.

References