CVE-2026-54567

Summary

Flask-Reuploaded provides file uploads for Flask. From 1.5.0 until 1.6.0, UploadSet.save(storage, name=…) in src/flask_uploads/flask_uploads.py applies lowercase_ext to the default upload path but uses the case-preserving extension helper for a caller-supplied name before extension_allowed evaluates an AllExcept denylist. An attacker who controls the name override can use a mixed-case dangerous extension to bypass a lowercase denylist and store the file in the served upload directory. Exploitation requires a denylist configuration, a user-influenced name override, and a deployment that resolves or executes extensions case-insensitively; pure allowlists remain protected and path containment is not bypassed. On an execution-capable upload directory, the stored file can execute with the web server's privileges and affect confidentiality, integrity, and availability. This issue is fixed in version 1.6.0.

Affected Software

VendorProductVersion RangeStatus
jugmac00flask-reuploaded< 1.6.0affected

Weaknesses

  • CWE-178: CWE-178: Improper Handling of Case Sensitivity
  • CWE-434: CWE-434: Unrestricted Upload of File with Dangerous Type

References