CVE-2026-27641-Flask-Reuploaded

CVE-2026-27641 is a critical security vulnerability affecting versions of the Flask-Reuploaded library. It allows remote attackers to achieve arbitrary file writes Versions affected: 1.5.0 To test the vulnerability: python3 -m venv flaskreuploadedvenv In flaskreuploadedvenv: pip install...

Flask-Reuploaded File Loading Code Execution

The vulnerability of the Flask-Reuploaded file loading library is related to deficiencies in the mechanism for processing registry-dependent data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2026-54567

Flask-Reuploaded provides file uploads for Flask. From 1.5.0 until 1.6.0, UploadSet.savestorage, name=... in src/flaskuploads/flaskuploads.py applies lowercaseext to the default upload path but uses the case-preserving extension helper for a caller-supplied name before extensionallowed evaluates ...

CVE-2026-54567 Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)

Flask-Reuploaded provides file uploads for Flask. From 1.5.0 until 1.6.0, UploadSet.savestorage, name=... in src/flaskuploads/flaskuploads.py applies lowercaseext to the default upload path but uses the case-preserving extension helper for a caller-supplied name before extensionallowed evaluates ...

coati-payroll (>=1.0.1, <=1.10.2), now-lms (>=1.0.3, <=2.0.0) +1 more potentially affected by CVE-2026-54567 via flask-reuploaded (>=1.2.0, <=1.5.0)

flask-reuploaded PYPI version =1.2.0, =1.0.1, =1.0.3, =4.6.1, =5.1.0 Source cves: CVE-2026-54567 Source advisory: MEND:CVE-2026-54567...

CVE-2026-54567 Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)

Flask-Reuploaded provides file uploads for Flask. From 1.5.0 until 1.6.0, UploadSet.savestorage, name=... in src/flaskuploads/flaskuploads.py applies lowercaseext to the default upload path but uses the case-preserving extension helper for a caller-supplied name before extensionallowed evaluates ...

EUVD-2026-77683

Flask-Reuploaded provides file uploads for Flask. From 1.5.0 until 1.6.0, UploadSet.savestorage, name=... in src/flaskuploads/flaskuploads.py applies lowercaseext to the default upload path but uses the case-preserving extension helper for a caller-supplied name before extensionallowed evaluates ...

CVE-2026-54567 Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)

Flask-Reuploaded provides file uploads for Flask. From 1.5.0 until 1.6.0, UploadSet.savestorage, name=... in src/flaskuploads/flaskuploads.py applies lowercaseext to the default upload path but uses the case-preserving extension helper for a caller-supplied name before extensionallowed evaluates ...

CVE-2026-54567

Flask-Reuploaded versions from 1.5.0 to before 1.6.0 are affected by a case-folding asymmetry in the name-override path of UploadSet.save(). When a caller supplies a name override, the extension re-validation uses the case-preserving extension() helper instead of the case-normalizing lowercase_ex...

CVE-2026-54567: Improper Handling of Case Sensitivity

Flask-Reuploaded provides file uploads for Flask. From 1.5.0 until 1.6.0, UploadSet.savestorage, name=... in src/flaskuploads/flaskuploads.py applies lowercaseext to the default upload path but uses the case-preserving extension helper for a caller-supplied name before extensionallowed evaluates ...

Flask-Reuploaded Path Traversal

The vulnerability of the Flask-Reuploaded file loading library is related to an incorrect restriction on the path name to the directory. Exploiting this vulnerability could allow an attacker to gain unauthorized access to write arbitrary files or execute arbitrary code by injecting templates at t...

Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)

Header| Field | Value ||---|---|| Title | Extension-denylist bypass via case-folding asymmetry in name-override path incomplete-fix variant of CVE-2026-27641 || Project | Flask-Reuploaded flaskuploads || Affected | extension"shell.php" = "php" - extensionallowed"php" - DENY correctname-override...

coati-payroll (>=1.0.1, <=1.10.2), now-lms (>=1.0.3, <=2.0.0) +1 more potentially affected by CVE-2026-54567 via flask-reuploaded (>=1.2.0, <=1.5.0)

flask-reuploaded PYPI version =1.2.0, =1.0.1, =1.0.3, =4.6.1, =5.1.0 Source cves: CVE-2026-54567 Source advisory: OSV:PYSEC-2026-3466...

PYSEC-2026-3466 Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)

Header | Field | Value | |---|---| | Title | Extension-denylist bypass via case-folding asymmetry in name-override path incomplete-fix variant of CVE-2026-27641 | | Project | Flask-Reuploaded flaskuploads | | Affected | extension"shell.php" = "php" - extensionallowed"php" - DENY correct...

Exploit for Path Traversal in Jugmac00 Flask-Reuploaded

CVE-2026-27641 is a critical security vulnerability affecting ve...

CVE-2026-54567

creationtimestamp| type| source ---|---|--- 2026-07-17 22:35:08+00:00| published-proof-of-concept| https://github.com/jugmac00/flask-reuploaded/security/advisories/GHSA-937x-gpqr-72gg...

Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)

Header | Field | Value | |---|---| | Title | Extension-denylist bypass via case-folding asymmetry in name-override path incomplete-fix variant of CVE-2026-27641 | | Project | Flask-Reuploaded flaskuploads | | Affected | extension"shell.php" = "php" - extensionallowed"php" - DENY correct...

coati-payroll (>=1.0.1, <=1.10.2), now-lms (>=1.0.3, <=2.0.0) +1 more potentially affected by CVE-2026-54567 via flask-reuploaded (>=1.2.0, <=1.5.0)

flask-reuploaded PYPI version =1.2.0, =1.0.1, =1.0.3, =4.6.1, =5.1.0 Source cves: CVE-2026-54567 Source advisory: OSV:GHSA-937X-GPQR-72GG...

coati-payroll (>=1.0.1, <=1.10.2), now-lms (>=1.0.3, <=2.0.0) +1 more potentially affected by CVE-2026-27641 +1 more via flask-reuploaded (>=1.2.0, <=1.5.0)

flask-reuploaded PYPI version =1.2.0, =1.0.1, =1.0.3, =4.6.1, =5.1.0 Source cves: CVE-2026-27641, CVE-2026-54567 Source advisory: GHSA-937X-GPQR-72GG...

coati-payroll (>=1.0.1, <=1.10.2), now-lms (>=1.0.3, <=2.0.0) +1 more potentially affected by CVE-2026-54567 via flask-reuploaded (>=1.2.0, <=1.5.0)

flask-reuploaded PYPI version =1.2.0, =1.0.1, =1.0.3, =4.6.1, =5.1.0 Source cves: CVE-2026-54567 Source advisory: SNYK:PYTHON-FLASKREUPLOADED-18319702...