PT-2026-47546 · Pypi · Dash-Uploader

Published 2026-05-08 · Updated 2026-05-08

OSV

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Impact

An unauthenticated path traversal vulnerability exists in dash-uploader versions 0.1.0 through 0.7.0a2. The library's HTTP request handler at dash uploader/httprequesthandler.py reads three form parameters (upload id, resumableFilename, resumableIdentifier) from request.form.get() and passes them directly to os.path.join() and os.makedirs() without any sanitization.

A single unauthenticated POST /API/dash-uploader request with upload id set to a relative path (e.g. ../../etc/cron.d or ../venv/lib/python3.13/site-packages) escapes the application's uploads/ directory and writes the supplied file content to the chosen target path under the privilege of the gunicorn / WSGI process.

When the chosen target is a Python site-packages directory and the dropped file is a .pth file containing an import-prefixed line, Python's site module executes that line on the next interpreter startup, yielding remote code execution. Other escalation paths reachable from the same primitive include overwriting the running WSGI module, dropping ~/.ssh/authorized keys, or writing JavaScript into a Dash-served assets/ directory for stored XSS.

Affected versions

All 16 published PyPI releases (0.1.0 through 0.7.0a2) are affected. The package repository was archived on 2025-07-19; no patched version exists.

Mitigation

Replace dash-uploader with an alternative file-upload component (for example, dash-resumable-upload, server-rendered <input type="file"> plus a hardened Flask endpoint, or a maintained Dash community alternative). There is no upstream fix path.

While a replacement is being deployed, mitigations include:

• Block POST /API/dash-uploader at an upstream proxy, OR
• Run the application as an unprivileged user with no write access to its own site-packages, OR
• Use a read-only filesystem for the application's code directories.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

GHSA-3RF6-X59V-5JFV

Affected Products

Dash-Uploader

References · 9

• 🔥 https://github.com/a1ohadance/CVE-2026-38360 · Exploit
• https://osv.dev/vulnerability/GHSA-3rf6-x59v-5jfv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-38360 · Security Note
• https://github.com/fohrloop/dash-uploader/blob/dev/dash_uploader/httprequesthandler.py · Note
• https://github.com/fohrloop/dash-uploader/issues/153 · Note
• https://github.com/fohrloop/dash-uploader · Note
• https://github.com/fohrloop/dash-uploader/blob/stable/dash_uploader/httprequesthandler.py · Note
• https://pypi.org/project/dash-uploader · Note
• ❌ https://github.com/lmigtech/dash_uploader · Note, Deleted