Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-54567— Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)

Quick assessment

Affected
jugmac00 flask-reuploaded
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Jürgen Gmach Flask-Reuploaded是Jürgen Gmach个人开发者的一个为网络应用提供文件上传处理功能的轻量级扩展。 Jürgen Gmach Flask-Reuploaded 1.5.0至1.6.0之前版本存在安全漏洞，该漏洞源于src/flask_uploads/flask_uploads.py中UploadSet.save函数对调用者提供的name参数使用保留大小写的扩展名处理，而未像默认上传路径一样应用lowercase_ext，导致攻击者可通过混合大小写的危险扩展名绕

CVSS 7.5 · High EPSS 0.58% · P46

Affected Version Matrix 1

VendorProduct Version RangeStatus
jugmac00 flask-reuploaded < 1.6.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-54567

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)
Source: CVE Program / CVE List V5
Vulnerability Description
Flask-Reuploaded provides file uploads for Flask. From 1.5.0 until 1.6.0, UploadSet.save(storage, name=...) in src/flask_uploads/flask_uploads.py applies lowercase_ext to the default upload path but uses the case-preserving extension helper for a caller-supplied name before extension_allowed evaluates an AllExcept denylist. An attacker who controls the name override can use a mixed-case dangerous extension to bypass a lowercase denylist and store the file in the served upload directory. Exploitation requires a denylist configuration, a user-influenced name override, and a deployment that resolves or executes extensions case-insensitively; pure allowlists remain protected and path containment is not bypassed. On an execution-capable upload directory, the stored file can execute with the web server's privileges and affect confidentiality, integrity, and availability. This issue is fixed in version 1.6.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
大小写敏感处理不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Jürgen Gmach Flask-Reuploaded 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Jürgen Gmach Flask-Reuploaded是Jürgen Gmach个人开发者的一个为网络应用提供文件上传处理功能的轻量级扩展。 Jürgen Gmach Flask-Reuploaded 1.5.0至1.6.0之前版本存在安全漏洞，该漏洞源于src/flask_uploads/flask_uploads.py中UploadSet.save函数对调用者提供的name参数使用保留大小写的扩展名处理，而未像默认上传路径一样应用lowercase_ext，导致攻击者可通过混合大小写的危险扩展名绕
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
jugmac00 flask-reuploaded < 1.6.0 -

II. Public POCs for CVE-2026-54567

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-54567

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-54567 (2)

Vendor Advisories for CVE-2026-54567 (1)

IV. Related Vulnerabilities

Same product: flask-reuploaded
Same vendor: jugmac00
Same weakness: CWE-178

V. Comments for CVE-2026-54567

No comments yet

Leave a comment