critical vulnerability

Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection

Fix availableCritical · CVSS 9.8EPSS 1.3%

Published Feb 25, 2026 · updated Oct 27, 2026

What to do

Upgrade to a fixed version: flask-reuploaded 1.5.0.
Redeploy and restart long-running processes so they load the fixed code.

Affected packages

PyPIflask-reuploaded3,122 downloads/week

Vulnerable versions: < 1.5.0
Fixed in: 1.5.0

Check your project: pip show flask-reuploaded

Sources

GitHub Advisory GHSA-65mp-fq8v-56jr
NVD CVE-2026-27641

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') · CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine

← All critical vulnerabilities