Skip to content
OpenAdvisories

Package · PyPI

flask-reuploaded

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 7.5
    CVE-2026-54567

    Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)

    Flask-Reuploaded provides file uploads for Flask. From 1.5.0 until 1.6.0, UploadSet.save(storage, name=...) in src/flask_uploads/flask_uploads.py applies lowercase_ext to the default upload path but uses the case-preserving extension helper for a caller-suppl…

    jugmac00 flask-reuploaded flask-reuploaded PyPI
  • Critical 9.8
    CVE-2026-27641 Public exploit

    Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection

    Flask-Reuploaded provides file uploads for Flask. A critical path traversal and extension bypass vulnerability in versions prior to 1.5.0 allows remote attackers to achieve arbitrary file write and remote code execution through Server-Side Template Injection …

    jugmac00 flask-reuploaded flask-reuploaded PyPI