No access to your tenant or devices. Every item links to its source. What this means
Flask-Reuploaded provides file uploads for Flask. From 1.5.0 until 1.6.0, UploadSet.save(storage, name=...) in src/flask_uploads/flask_uploads.py applies lowercase_ext to the default upload path but uses the case-preserving extension helper for a caller-supplied name before extension_allowed evaluates an AllExcept denylist. An attacker who controls the name override can use a mixed-case dangerous extension to bypass a lowercase denylist and store the file in the served upload directory. Exploitation requires a denylist configuration, a user-influenced name override, and a deployment that resolves or executes extensions case-insensitively; pure allowlists remain protected and path containment is not bypassed. On an execution-capable upload directory, the stored file can execute with the web server's privileges and affect confidentiality, integrity, and availability. This issue is fixed in version 1.6.0.
Read the publisher's advisoryVendor product
Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "jugmac00",
"product": "flask-reuploaded",
"versions": [
{
"version": "< 1.6.0",
"status": "affected"
}
]
}Original source record · Cite this exact observation · Complete original publisher JSON