---
id: CVE-2026-27641
aliases:
  - GHSA-65mp-fq8v-56jr
  - PYSEC-2026-341
title: >-
  Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template
  Injection
summary: >-
  Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template
  Injection
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
vendor: flask-reuploaded
product: flask-reuploaded
ecosystem: pip
affected:
  - flask-reuploaded < 1.5.0
patched:
  - flask-reuploaded 1.5.0
published: '2026-02-25'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T17:00:03.992051129Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-65mp-fq8v-56jr'
references:
  - url: >-
      https://github.com/jugmac00/flask-reuploaded/security/advisories/GHSA-65mp-fq8v-56jr
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-27641'
  - url: 'https://github.com/jugmac00/flask-reuploaded/pull/180'
  - url: >-
      https://github.com/jugmac00/flask-reuploaded/commit/d64c6b2f71cb73734fc38baa0e3e156926361288
  - url: 'https://github.com/jugmac00/flask-reuploaded'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/flask-reuploaded/PYSEC-2026-341.yaml
  - url: 'https://pypi.org/project/flask-reuploaded'
  - url: 'https://github.com/advisories/GHSA-65mp-fq8v-56jr'
tags:
  - osv
  - pip
  - exploit-available
  - ghsa
epss: 0.01337
epssPercentile: 0.71066
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/Max78000/CVE-2026-27641-Flask-Reuploaded'
  checkedAt: '2026-10-27T18:16:08.386Z'
exploitAvailable: true
cwe:
  - CWE-22
  - CWE-1336
ingestedAt: '2026-10-27T17:33:23.776Z'
---

## Overview

### Impact
A critical path traversal and extension bypass vulnerability in Flask-Reuploaded allows remote attackers to achieve arbitrary file write and remote code execution through Server-Side Template Injection (SSTI).

### Patches
Flask-Reuploaded has been patched in version 1.5.0

### Workarounds

1. **Do not pass user input to the `name` parameter**
2. Use auto-generated filenames only
3. Implement strict input validation if `name` must be used

```python
from werkzeug.utils import secure_filename
import os

# Sanitize user input before passing to save()
safe_name = secure_filename(request.form.get('custom_name'))
# Remove path separators
safe_name = os.path.basename(safe_name)
# Validate extension matches policy
if not photos.extension_allowed(photos.get_extension(safe_name)):
    abort(400)
    
filename = photos.save(file, name=safe_name)
```

### Resources
The fix is documented in the pull request, see https://github.com/jugmac00/flask-reuploaded/pull/180.

A proper write-up was created by the reporter of the vulnerability, Jaron Cabral (https://www.linkedin.com/in/jaron-cabral-751994357/), but is not yet available as of time of this publication.

## Affected packages

- `flask-reuploaded < 1.5.0`

## Remediation

Upgrade to a patched release:

- `flask-reuploaded 1.5.0`