Vulnerability Description
Flask-Reuploaded provides file uploads for Flask. From 1.5.0 until 1.6.0, UploadSet.save(storage, name=...) in src/flask_uploads/flask_uploads.py applies lowercase_ext to the default upload path but uses the case-preserving extension helper for a caller-supplied name before extension_allowed evaluates an AllExcept denylist. An attacker who controls the name override can use a mixed-case dangerous extension to bypass a lowercase denylist and store the file in the served upload directory. Exploitation requires a denylist configuration, a user-influenced name override, and a deployment that resolves or executes extensions case-insensitively; pure allowlists remain protected and path containment is not bypassed. On an execution-capable upload directory, the stored file can execute with the web server's privileges and affect confidentiality, integrity, and availability. This issue is fixed in version 1.6.0.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/jugmac00/flask-reuploaded/commit/5ded76092429c6eb8a4af941b14f
- https://github.com/jugmac00/flask-reuploaded/pull/186
- https://github.com/jugmac00/flask-reuploaded/security/advisories/GHSA-937x-gpqr-
- https://github.com/jugmac00/flask-reuploaded/security/advisories/GHSA-937x-gpqr-
FAQ
What is CVE-2026-54567?
CVE-2026-54567 is a vulnerability with a CVSS score of 7.5 (HIGH). Flask-Reuploaded provides file uploads for Flask. From 1.5.0 until 1.6.0, UploadSet.save(storage, name=...) in src/flask_uploads/flask_uploads.py applies lowercase_ext to the default upload path but u...
How severe is CVE-2026-54567?
CVE-2026-54567 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-54567?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.