flask-reuploaded vulnerabilities

2 known vulnerabilities in flask-reuploaded from Jugmac00. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  flask-reuploaded: Improper Handling of Case Sensitivity

  CVE-2026-54567Sep 14, 2026Jugmac00

  Flask-Reuploaded provides file uploads for Flask. From 1.5.0 until 1.6.0, UploadSet.save(storage, name=...) in src/flask_uploads/flask_uploads.py applies lowercase_ext to the default upload path but uses the case-preserving extension helper for a caller-suppli

• 9.8 Critical severity

  flask-reuploaded: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-27641Feb 25, 2026Jugmac00EPSS 1.34%

  Flask-Reuploaded provides file uploads for Flask. A critical path traversal and extension bypass vulnerability in versions prior to 1.5.0 allows remote attackers to achieve arbitrary file write and remote code execution through Server-Side Template Injection (