CVE-2026-54567
Flask-Reuploaded provides file uploads for Flask. From 1.5.0 until 1.6.0, UploadSet.save(storage, name=...) in src/flask_uploads/flask_uploads.py applies lowercase_ext to the default upload path but uses the case-preserving extension helper for a caller-supplied name before extension_allowed evaluates an AllExcept denylist. An attacker who controls the name override can use a mixed-case dangerous extension to bypass a lowercase denylist and store the file in the served upload directory. Exploitation requires a denylist configuration, a user-influenced name override, and a deployment that resolves or executes extensions case-insensitively; pure allowlists remain protected and path containment is not bypassed. On an execution-capable upload directory, the stored file can execute with the web server's privileges and affect confidentiality, integrity, and availability. This issue is fixed in version 1.6.0.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 0.58%
- CWE
- CWE-178, CWE-434
- Published
- 2026-09-14
- Last modified
- 2026-09-16
Affected products
- jugmac00 flask-reuploaded
Weakness type
Related vulnerabilities
- CVE-2023-3545 — Chamilo LMS Htaccess File Upload Security Bypass
- CVE-2023-4759 — Improper handling of case insensitive filesystems in Eclipse JGit allows arbitrary file write
- CVE-2025-46701 — Apache Tomcat: Security constraint bypass for CGI scripts
- CVE-2026-43513 — Apache Tomcat: LockOutRealm treats user names as case-sensitive
- CVE-2025-67718 — Formio improperly authorized permission elevation through specially crafted request path
- CVE-2026-40453 — Apache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub: Incomplete fix for CVE-2025-27636 in non-HTTP HeaderFilterStrategies (camel-jms, camel-sjms, camel-coap, camel-google-pubsub) allows case-variant header injection
- CVE-2021-39155 — Authorization Policy Bypass Due to Case Insensitive Host Comparison
- CVE-2026-47323 — Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering