p PatchFirst

CVE-2026-27641

CVE-2026-27641 · Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Flask-Reuploaded provides file uploads for Flask. A critical path traversal and extension bypass vulnerability in versions prior to 1.5.0 allows remote attackers to achieve arbitrary file write and remote code execution through Server-Side Template Injection (SSTI). Flask-Reuploaded has been patched in version 1.5.0. Some workarounds are available. Do not pass user input to the `name` parameter, use auto-generated filenames only, and implement strict input validation if `name` must be used.

CVSS 9.8 · Critical · EPSS 1.3% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • flask-reuploaded

    Versions
    • < 1.5.0: Affected

    No fix published

  • flask-reuploaded PyPI

    Versions
    • 0.3
    • 0.3.1
    • 0.3.2
    • 0.4.0
    • 0.5.0
    • 1.0.0
    • 1.1.0
    • 1.2.0
    • 1.3.0
    • 1.4.0
    Affected ranges
    • ECOSYSTEM: < 1.5.0

    Update to 1.5.0

Original sources

Check your server →