9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27641

CVE-2026-27641: Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection

Impact

A critical path traversal and extension bypass vulnerability in Flask-Reuploaded allows remote attackers to achieve arbitrary file write and remote code execution through Server-Side Template Injection (SSTI).

Patches

Flask-Reuploaded has been patched in version 1.5.0

Workarounds

Do not pass user input to the name parameter
Use auto-generated filenames only
Implement strict input validation if name must be used

from werkzeug.utils import secure_filename
import os

# Sanitize user input before passing to save()
safe_name = secure_filename(request.form.get('custom_name'))
# Remove path separators
safe_name = os.path.basename(safe_name)
# Validate extension matches policy
if not photos.extension_allowed(photos.get_extension(safe_name)):
    abort(400)
    
filename = photos.save(file, name=safe_name)

Resources

The fix is documented in the pull request, see https://github.com/jugmac00/flask-reuploaded/pull/180.

A proper write-up was created by the reporter of the vulnerability, Jaron Cabral (https://www.linkedin.com/in/jaron-cabral-751994357/), but is not yet available as of time of this publication.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27641

CVE-2026-27641:

9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
flask-reuploaded	pip	< 1.5.0	1.5.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The security vulnerability exists in the save method of the UploadSet class within flask_uploads/flask_uploads.py. The analysis of the patch commit d64c6b2f71cb73734fc38baa0e3e156926361288 reveals that the user-controlled name and folder parameters were used to construct the final file path without sufficient sanitization. This created two critical flaws. First, a path traversal vulnerability, where an attacker could provide a name like ../../../../tmp/pwned.txt to write a file to an arbitrary location on the server. Second, an extension bypass vulnerability. The library would check the extension of the original uploaded file, but if the attacker provided a new name (e.g., backdoor.html), the library would use this new name without re-validating the now-dangerous extension against the configured rules. This could lead to Remote Code Execution if, for example, the file was uploaded to a directory used by a template engine. The patch rectifies these issues by applying werkzeug.utils.secure_filename to both the name and folder parameters, re-validating the file extension after the name is potentially overridden, and adding a final check to ensure the resolved absolute path of the file to be saved is strictly within the configured upload destination.

Vulnerable functions

UploadSet.save

src/flask_uploads/flask_uploads.py

The `save` function was vulnerable to path traversal and file extension bypass. It did not properly sanitize the `name` and `folder` parameters, allowing an attacker to use `../` sequences to write files outside of the intended destination directory. Furthermore, when a custom `name` was provided, the function did not re-validate the file extension against the configured allowlist. This allowed an attacker to upload a file with a dangerous type (e.g., an HTML file with template code) to a sensitive location, leading to Remote Code Execution through Server-Side Template Injection (SSTI).

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.