Skip to content
OpenAdvisories
High USN-6019-1 1 CVE

python-flask-cors vulnerability

Published Apr 13, 2023 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Flask-CORS did not properly escape paths before
evaluating resource rules. An attacker could possibly use this to
expose sensitive information.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS python-flask-cors 3.0.8-2ubuntu0.1

Vulnerabilities 1

  • High 7.5
    CVE-2020-25032

    Flask-Cors Directory Traversal vulnerability

    An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.

    flask-cors python-flask-cors python-flask-cors Debian Ubuntu PyPI

References

  • report
    https://ubuntu.com/security/CVE-2020-25032