CVE-2026-27641 PUBLISHED

Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection

Assigner: GitHub_M
Reserved: 20.02.2026 Published: 25.02.2026 Updated: 25.02.2026

Flask-Reuploaded provides file uploads for Flask. A critical path traversal and extension bypass vulnerability in versions prior to 1.5.0 allows remote attackers to achieve arbitrary file write and remote code execution through Server-Side Template Injection (SSTI). Flask-Reuploaded has been patched in version 1.5.0. Some workarounds are available. Do not pass user input to the name parameter, use auto-generated filenames only, and implement strict input validation if name must be used.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8

Product Status

Vendor jugmac00
Product flask-reuploaded
Versions
  • Version < 1.5.0 is affected

References

Problem Types

  • CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine CWE