GHSA-65mp-fq8v-56jr

Source

https://github.com/advisories/GHSA-65mp-fq8v-56jr

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-65mp-fq8v-56jr/GHSA-65mp-fq8v-56jr.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-65mp-fq8v-56jr

Aliases

Published

2026-02-25T19:06:50Z

Modified

2026-06-29T12:26:48Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection

Details

Impact

A critical path traversal and extension bypass vulnerability in Flask-Reuploaded allows remote attackers to achieve arbitrary file write and remote code execution through Server-Side Template Injection (SSTI).

Patches

Flask-Reuploaded has been patched in version 1.5.0

Workarounds

Do not pass user input to the name parameter
Use auto-generated filenames only
Implement strict input validation if name must be used

from werkzeug.utils import secure_filename
import os

# Sanitize user input before passing to save()
safe_name = secure_filename(request.form.get('custom_name'))
# Remove path separators
safe_name = os.path.basename(safe_name)
# Validate extension matches policy
if not photos.extension_allowed(photos.get_extension(safe_name)):
    abort(400)
    
filename = photos.save(file, name=safe_name)

Resources

The fix is documented in the pull request, see https://github.com/jugmac00/flask-reuploaded/pull/180.

A proper write-up was created by the reporter of the vulnerability, Jaron Cabral (https://www.linkedin.com/in/jaron-cabral-751994357/), but is not yet available as of time of this publication.

Database specific

{
    "cwe_ids":  [
        "CWE-1336",
        "CWE-22"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-02-25T19:06:50Z",
    "nvd_published_at":  "2026-02-25T04:16:04Z",
    "severity":  "CRITICAL"
}

References

Affected packages

PyPI / flask-reuploaded

Package

Name: flask-reuploaded; View open source insights on deps.dev
Purl: pkg:pypi/flask-reuploaded

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.5.0

Affected versions

0.*

0.3

0.3.1

0.3.2

0.4.0

0.5.0

1.*

1.0.0

1.1.0

1.2.0

1.3.0

1.4.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-65mp-fq8v-56jr/GHSA-65mp-fq8v-56jr.json"