Executive brief
Flask-Reuploaded, a library used by web applications to handle file uploads, contains a flaw that allows attackers to bypass security restrictions on file types. By slightly changing the capitalization of a file extension (e.g., using .PHP instead of .php), an attacker can upload restricted scripts to a server. If the server is configured to run these scripts regardless of their capitalization, the attacker could gain full control over the web server and access sensitive data.
Technical details
The vulnerability arises from an inconsistency in how file extensions are validated in the `UploadSet.save()` method when a `name` override is used. While the default upload path normalizes extensions to lowercase before checking them against a denylist, the name-override path uses a case-preserving helper. Consequently, a denylist containing 'php' will not block 'PHP' or 'pHp'. On case-insensitive filesystems (Windows/macOS) or web servers like Apache configured with case-insensitive handlers, this allows the upload and execution of restricted file types. This is an incomplete fix for CVE-2026-27641. The issue is addressed in version 1.6.0.
Affected products
- jugmac00 Flask-Reuploaded <= 1.5.0
Timeline
- 2026-06-06: disclosed
- 2026-07-17: advisory
- 2026-07-17: patched