Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability exists because the dash-uploader library fails to sanitize user-provided input from HTTP POST requests before using it in file system operations. The analysis of dash_uploader/httprequesthandler.py confirms this. The RequestData.__init__ method reads the upload_id, flowFilename (resumableFilename), and flowIdentifier (resumableIdentifier) parameters from the request form. These values are then passed to the BaseHttpRequestHandler._post method, which handles the file upload. Inside _post, the get_upload_session_root function directly concatenates the upload_id with the base upload folder, allowing directory traversal. Subsequently, both _post and _get methods use os.path.join or pathlib.Path to construct full paths for directories and files using these unsanitized inputs. This allows an unauthenticated attacker to craft a request with relative path components (e.g., ../../) in the upload_id to write or check for files anywhere on the filesystem that the application process has write access to, leading to arbitrary file write, information disclosure, and potential remote code execution.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| dash-uploader | pip | >= 0.1.0, <= 0.7.0a2 |
