CVE-2026-27641
📋 TL;DR
A critical path traversal and extension bypass vulnerability in Flask-Reuploaded versions before 1.5.0 allows remote attackers to write arbitrary files and achieve remote code execution via Server-Side Template Injection (SSTI). This affects any Flask application using vulnerable versions of Flask-Reuploaded for file upload functionality. Attackers can exploit this to compromise the server hosting the Flask application.
💻 Affected Systems
- Flask-Reuploaded
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise with remote code execution, data exfiltration, lateral movement, and persistent backdoor installation.
Likely Case
Arbitrary file write leading to web shell deployment, data manipulation, or denial of service through critical file overwrites.
If Mitigated
Limited impact with proper input validation and security controls, potentially only file upload failures or minor data corruption.
🎯 Exploit Status
Exploitation is straightforward with public proof-of-concept available. The vulnerability allows path traversal and extension bypass leading to SSTI.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.5.0
Vendor Advisory: https://github.com/jugmac00/flask-reuploaded/security/advisories/GHSA-65mp-fq8v-56jr
Restart Required: Yes
Instructions:
1. Update Flask-Reuploaded to version 1.5.0 or later using pip: pip install --upgrade Flask-Reuploaded>=1.5.0
2. Restart the Flask application
3. Verify the update with: pip show Flask-Reuploaded
🔧 Temporary Workarounds
Use auto-generated filenames
allAvoid passing user-controlled input to the name parameter by using auto-generated filenames only
Implement strict input validation
allIf using the name parameter, implement strict validation to prevent path traversal and extension bypass
🧯 If You Can't Patch
- Disable file upload functionality entirely if not required
- Implement web application firewall (WAF) rules to block path traversal patterns and suspicious uploads
🔍 How to Verify
Check if Vulnerable:
Check Flask-Reuploaded version with: pip show Flask-Reuploaded | grep VersionCheck Version:
pip show Flask-Reuploaded | grep VersionVerify Fix Applied:
Verify version is 1.5.0 or higher: pip show Flask-Reuploaded | grep Version📡 Detection & Monitoring
Log Indicators:
- Unusual file upload patterns
- Path traversal attempts in upload filenames
- Suspicious file extensions in uploads
- Unexpected file writes outside upload directory
Network Indicators:
- Multiple file upload attempts with crafted filenames
- POST requests to upload endpoints with path traversal payloads
SIEM Query:
source="web_logs" AND (url_path="/upload" OR url_path LIKE "%/upload%") AND (request_body LIKE "%..%" OR request_body LIKE "%name=%..%")