CVE-2026-38361

🗓️ 08 May 2026 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 20 Views🌐 WEB

CVE-2026-38361 enables remote code execution in fohrloop dash-uploader via the Upload function and max_file_size.

Reporter	Title	Published	Views	Family All 21
GithubExploit	Exploit for CVE-2026-38360	7 May 202614:59	–	githubexploit
GithubExploit	Exploit for CVE-2026-38361	7 May 202620:32	–	githubexploit
GithubExploit	Exploit for CVE-2026-38360	7 May 202620:32	–	githubexploit
ATTACKERKB	CVE-2026-38361	8 May 202600:00	–	attackerkb
BDU FSTEC	The vulnerability of the Upload() function in the dash-uploader library allows a hacker to trigger a service failure.	12 May 202600:00	–	bdu_fstec
Circl	CVE-2026-38361	7 May 202615:00	–	circl
CNNVD	dash-uploader 资源管理错误漏洞	8 May 202600:00	–	cnnvd
Cvelist	CVE-2026-38361	8 May 202600:00	–	cvelist
EUVD	EUVD-2026-28645	8 May 202615:31	–	euvd
Nuclei	dash-uploader 0.1.0 - 0.7.0a2 - Denial-of-Service via flowTotalChunks	13 Jul 202604:38	–	nuclei

NVD

Node

fohrloop dash-uploaderRange0.1.0–0.6.1python

fohrloop dash-uploaderMatch0.7.0alpha1python

fohrloop dash-uploaderMatch0.7.0alpha2python

Source	Link
pepy	www.pepy.tech/project/dash-uploader
docs	www.docs.python.org/3/library/functions.html
github	www.github.com/github/advisory-database/pull/7636
github	www.github.com/advisories/GHSA-xp7f-v245-w3w8
pypistats	www.pypistats.org/packages/dash-uploader
github	www.github.com/fohrloop/dash-uploader/blob/stable/dash_uploader/httprequesthandler.py
pypi	www.pypi.org/project/dash-uploader/
github	www.github.com/a1ohadance/CVE-2026-38361
github	www.github.com/fohrloop/dash-uploader/issues/153
libraries	www.libraries.io/pypi/dash-uploader

Parameter	Position	Path	Description	CWE
resumableTotalChunks	request body	/API/resumable	Unauthenticated DoS via attacker-controlled resumableTotalChunks triggering unbounded memory allocation.	CWE-400, CWE-670
resumableTotalSize	request body	/API/resumable	Unauthenticated DoS via attacker-controlled resumableTotalChunks triggering unbounded memory allocation.	CWE-400, CWE-670
resumableFilename	request body	/API/resumable	Unauthenticated DoS via attacker-controlled resumableTotalChunks triggering unbounded memory allocation.	CWE-400, CWE-670
resumableIdentifier	request body	/API/resumable	Unauthenticated DoS via attacker-controlled resumableTotalChunks triggering unbounded memory allocation.	CWE-400, CWE-670
upload_id	request body	/API/dash-uploader	Unauthenticated path traversal allowing arbitrary file write to attacker-controlled destinations.	CWE-22
resumableFilename	request body	/API/dash-uploader	Unauthenticated path traversal allowing arbitrary file write to attacker-controlled destinations.	CWE-22
resumableIdentifier	request body	/API/dash-uploader	Unauthenticated path traversal allowing arbitrary file write to attacker-controlled destinations.	CWE-22

17 Jun 2026 10:41Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.17.5

EPSS0.02643

SSVC