PT-2026-21857 · Unknown · Flask-Reuploaded

Cjaron03 · Published 2026-02-25 · Updated 2026-03-02 · CVE-2026-27641

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Flask-Reuploaded versions prior to 1.5.0

Description Flask-Reuploaded, a file upload package for Flask, contains a path traversal and extension bypass flaw. This allows remote attackers to perform arbitrary file writes and achieve remote code execution (RCE) through Server-Side Template Injection (SSTI). Server-Side Template Injection (SSTI) is a web security vulnerability that allows an attacker to inject arbitrary code into a web application by exploiting template engines. The name parameter is a potential entry point for this issue.

Recommendations Upgrade to version 1.5.0 or later to resolve this issue. Do not pass user input to the name parameter. Use auto-generated filenames only. Implement strict input validation if the name parameter must be used.

Exploit

Fix

RCE

Path traversal

Weakness Enumeration

CWE-1336

CWE-22

Related Identifiers

CVE-2026-27641

GHSA-65MP-FQ8V-56JR

Affected Products

Flask-Reuploaded

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27641.json · Exploit
• https://github.com/jugmac00/flask-reuploaded/commit/d64c6b2f71cb73734fc38baa0e3e156926361288 · Patch
• https://github.com/jugmac00/flask-reuploaded/security/advisories/GHSA-65mp-fq8v-56jr · Vendor Advisory
• https://github.com/jugmac00/flask-reuploaded/pull/180 · Patch
• https://osv.dev/vulnerability/GHSA-65mp-fq8v-56jr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27641 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27641 · Security Note
• https://github.com/jugmac00/flask-reuploaded · Note
• https://t.me/CVEtracker/45683 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2026540381756662137 · Twitter Post
• https://twitter.com/CCBalert/status/2026670135453364263 · Twitter Post
• https://twitter.com/_alphashark_/status/2026671030920777781 · Twitter Post
• https://twitter.com/CveFindCom/status/2026517938216239169 · Twitter Post
• https://twitter.com/cracbot/status/2028425210370920919 · Twitter Post
• https://twitter.com/CVEnew/status/2026641348569289007 · Twitter Post