ZeroDay Findings
Sign inSign up

Findings

CVE-2026-27641

Flask-Reuploaded provides file uploads for Flask.

Published Feb 25, 2026 · updated Jun 17, 2026 · jugmac00 flask-reuploaded

Flask-Reuploaded provides file uploads for Flask. A critical path traversal and extension bypass vulnerability in versions prior to 1.5.0 allows remote attackers to achieve arbitrary file write and remote code execution through Server-Side Template Injection (SSTI). Flask-Reuploaded has been patched in version 1.5.0. Some workarounds are available. Do not pass user input to the parameter, use auto-generated filenames only, and implement strict input validation if must be used.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Feb 25, 2026 · NIST NVD

    Detected

    Flask-Reuploaded provides file uploads for Flask. A critical path traversal and extension bypass vulnerability in versions prior to 1.5.0 allows remote attackers to achieve arbitrary file write and remote code execution through Server-Side Template Injection (SSTI). Flask-Reuploaded has been patched in version 1.5.0. Some workarounds are available. Do not pass user input to the parameter, use auto

  2. Jun 17, 2026 · NIST NVD

    Updated

    Flask-Reuploaded provides file uploads for Flask. A critical path traversal and extension bypass vulnerability in versions prior to 1.5.0 allows remote attackers to achieve arbitrary file write and remote code execution through Server-Side Template Injection (SSTI). Flask-Reuploaded has been patched in version 1.5.0. Some workarounds are available. Do not pass user input to the parameter, use auto

Affected

  • cpe jugmac00/flask-reuploadedversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-27641

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-27641

    Flask-Reuploaded provides file uploads for Flask. A critical path traversal and extension bypass vulnerability in versions prior to 1.5.0 allows remote attackers to achieve arbitrary file write and remote code execution through Server-Side Template Injection (SSTI). Flask-Reuploa

    nvd.nist.gov

References