CVE-2026-27641: Flask-Reuploaded path traversal leads to RCE via SSTI

Overview

Flask-Reuploaded is a Python extension that provides file upload handling for Flask applications. GitHub's advisory, mirrored in the CVE record, describes a critical issue combining path traversal and an extension bypass that can lead to arbitrary file write and remote code execution through Server-Side Template Injection (SSTI). The weakness is classified as CWE-22 (Path Traversal) in the record.

Impact

• The record describes arbitrary file write by remote attackers and remote code execution through SSTI.
• The GitHub-provided CVSS base score is 9.8 (critical), with high confidentiality, integrity and availability impact and no privileges or user interaction required.
• SSVC data in the record marks the technical impact as total and exploitation as none, and states the issue is automatable.

Affected products and versions

• Product: Jugmac00 Flask-reuploaded.
• Affected: versions before 1.5.0.
• Fixed: version 1.5.0, as stated in the record description.
• The record does not list any affected version ranges beyond the one above.

Exploitation status

• CISA KEV does not list this CVE, so active exploitation is not confirmed by that source.
• No confirmed exploitation in the wild appears in the sources consulted.
• One reference in the record carries an Exploit tag in its metadata; this tag does not by itself confirm exploitation.
• EPSS gives a probability of 0.01384 with a percentile of 0.72002 in the record.

Remediation and mitigation

• Upgrade Flask-Reuploaded to version 1.5.0 or later, which the project states contains the fix.
• If an upgrade is not immediately possible, follow the workarounds listed in the record: do not pass user input to the name parameter, rely on auto-generated filenames only, and apply strict input validation if name must be used.
• Review applications that rely on this extension to confirm whether user-controlled data reaches file naming or template rendering paths.

Detection guidance

• Review upload logs for filenames containing directory separators, unexpected extensions or unusual characters.
• Check whether files appear in unexpected directories, especially web-accessible or template-related paths.
• Monitor application errors and unexpected template rendering behaviour, which may indicate injection attempts.
• Keep these checks high level; the record does not provide indicators of compromise.

Limitations of the available information

• The record does not describe the exact vulnerable code path, the precise bypass, or the full set of affected deployment configurations.
• The record does not state whether any public proof of concept exists beyond the Exploit tag on a reference.
• The EPSS date in the record is later than the publication date, so the EPSS values should be treated as a snapshot with uncertain timing.
• Sources consulted were the record and its listed references; no independent testing was performed.

Frequently asked questions

Which Flask-Reuploaded versions are affected by CVE-2026-27641?

The record lists versions before 1.5.0 as affected. The project states that version 1.5.0 contains the fix.

Is this vulnerability known to be actively exploited?

No. CISA KEV does not list this CVE, and no confirmed exploitation in the wild appears in the sources consulted.

What should I do if I cannot upgrade right away?

The record lists workarounds: do not pass user input to the name parameter, use only auto-generated filenames, and apply strict input validation if name must be used.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.