File Upload Vulnerability in Flask-Reuploaded by Jugmac

CVE-2026-54567

What is CVE-2026-54567?

The Flask-Reuploaded package, used for handling file uploads in Flask applications, contains a flaw that allows an attacker to bypass configured denylists through the use of mixed-case extensions in user-supplied names. This vulnerability, present in versions 1.5.0 to 1.6.0, results from a conflict between the case-sensitive nature of the extension check and the case-insensitive handling of filenames, enabling malicious files to be uploaded and executed with the web server's privileges. It is essential to correctly configure denylists to safeguard against this type of exploit, especially in environments where uploaded files are processed or executed.

References