CVE-2026-54567: Flask-Reuploaded Extension-Denylist Bypass via Case-Folding Asymmetry
Summary
CVE-2026-54567: 1. Affects flask-reuploaded versions < 1.6.0. Fixed in 1.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Flask-Reuploaded is an extension for Flask that simplifies file uploads in web applications. It provides functionalities such as file storage management and allows developers to define upload sets with specific rules for file types. However, a vulnerability has been identified that allows attackers to bypass the extension denylist, potentially leading to the upload of dangerous file types.
Vulnerability Detail
The vulnerability arises from an incomplete fix for CVE-2026-27641, where the extension re-validation process in the UploadSet.save() method does not properly handle case sensitivity. The extension validation uses a case-preserving method while the default upload path normalizes extensions to lowercase. This discrepancy allows attackers to upload files with dangerous extensions by manipulating the case of the file name, leading to potential remote code execution on servers that handle file extensions case-insensitively.
How To Fix
Latest published version: 1.6.0 as of 22 Oct 2026
pip install --upgrade "flask-reuploaded==1.6.0"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that your application does not allow user-defined names for uploaded files or implement additional checks to normalize the file extension before saving it. For example, you can modify the save method to include a normalization step: ext = extension(basename).lower() before checking against the denylist.
Conclusion
CVE-2026-54567 presents a significant risk for applications using Flask-Reuploaded, allowing for potential bypass of file upload restrictions. It is crucial to update to the latest version of the package and implement additional security measures to mitigate this vulnerability.
See every vulnerability recorded for flask-reuploaded →
FAQ
CVE-2026-54567 is a vulnerability in the Flask-Reuploaded package that allows attackers to bypass file extension denylists due to case-folding asymmetry.
If your application uses Flask-Reuploaded and allows file uploads, this vulnerability could enable attackers to upload files with dangerous extensions, potentially leading to remote code execution.
Update Flask-Reuploaded to version 1.6.0 or later to patch the vulnerability. Additionally, review your file upload handling to ensure proper validation.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
The CVSS score for CVE-2026-54567 is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for flask-reuploaded.
