Executive brief
fohrloop dash-uploader is a Python library used to handle file uploads in Plotly Dash applications. A security flaw allows unauthenticated remote attackers to bypass intended directory restrictions and write files anywhere on the server's filesystem. This can lead to complete system takeover, data theft, or permanent service disruption. As the project is archived and no official fix is planned, users are advised to migrate to alternative upload components.
Technical details
A directory traversal vulnerability (CWE-22) exists in dash-uploader versions 0.1.0 through 0.7.0a2. The vulnerability is located in dash_uploader/httprequesthandler.py, where the 'upload_id', 'resumableFilename', and 'resumableIdentifier' parameters from POST requests are passed directly to os.path.join() and os.makedirs() without sanitization. An unauthenticated attacker can use '..' sequences to escape the upload directory and write arbitrary content to sensitive locations, such as Python's site-packages or cron directories, resulting in remote code execution (RCE). The project was archived in July 2025 and no patch is available; users should migrate to Plotly Dash's built-in dcc.Upload or other maintained alternatives.
Affected products
- fohrloop dash-uploader 0.1.0 through 0.7.0a2
Timeline
- 2025-07-19: other: Project archived by maintainer
- 2026-05-08: disclosed
- 2026-05-08: advisory
References
- https://github.com/a1ohadance/CVE-2026-38360
- https://github.com/fohrloop/dash-uploader
- https://github.com/fohrloop/dash-uploader/blob/dev/dash_uploader/httprequesthandler.py
- https://github.com/fohrloop/dash-uploader/blob/stable/dash_uploader/httprequesthandler.py
- https://github.com/fohrloop/dash-uploader/issues/153