Junglewise Threat Intelligence

CVE-2026-27641: PYSEC-2026-341 - Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection

CVE-2026-27641 · Severity: low · CVSS 3.1 · Published 2026-06-29

Vendors: PyPI.

Executive brief

Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection

Affected products

PyPI Flask-Reuploaded

Related threats

Flask-Reuploaded provides file uploads for Flask. From 1.5.0 until 1.6.0, UploadSet.save(storage, name=...) in src/flask_uploads/flask_uploa