CVE-2020-25032: Insecure input handling in Flask-Cors
Summary
CVE-2020-25032: Flask-Cors Directory Traversal vulnerability. Affects flask-cors versions < 3.0.9. Fixed in 3.0.9. How to fix ↓
Also tracked for
- python-flask-cors · Debian:11
The same CVE-2020-25032 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Flask-Cors is a middleware for Flask, a popular Python web framework. It provides Cross-Origin Resource Sharing (CORS) support, allowing web applications to make requests to different domains. Flask-Cors helps in handling CORS-related issues and ensures secure communication between client and server. However, a vulnerability has been discovered in Flask-Cors before version 3.0.9, which allows directory traversal and unauthorized access to private resources. This vulnerability arises due to improper input handling and resource matching, which does not validate pathnames in a canonical format.
Vulnerability Detail
The vulnerability (CVE-2020-25032) in Flask-Cors allows an attacker to perform directory traversal and access private resources. By exploiting this vulnerability, an attacker can bypass security measures and gain unauthorized access to sensitive files or directories on the server. This can lead to information disclosure, data manipulation, or even remote code execution. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 6.0.5 as of 23 Oct 2026
pip install --upgrade "flask-cors==6.0.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.0.9
This is the first release that contains the fix.
pip install --upgrade "flask-cors==3.0.9"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating Flask-Cors is not immediately possible, a temporary workaround can be implemented by manually validating and sanitizing user input. This can be done by ensuring that pathnames are in a canonical format and do not contain any directory traversal sequences. Additionally, access controls and permissions should be carefully configured to restrict access to private resources.
Conclusion
In summary, the vulnerability in Flask-Cors (CVE-2020-25032) allows directory traversal and unauthorized access to private resources. It is crucial to update Flask-Cors to version 3.0.9 or later to mitigate this vulnerability. Implementing proper input validation, sanitization, and access controls is also recommended. For further assistance or support in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for flask-cors →
FAQ
Flask-Cors is a middleware for Flask that provides Cross-Origin Resource Sharing (CORS) support, allowing web applications to make requests to different domains.
Directory traversal is a security vulnerability that allows an attacker to access files or directories outside of the intended scope. It occurs when input validation or sanitization is not properly performed, allowing attackers to manipulate file paths and bypass security measures.
The vulnerability in Flask-Cors can lead to unauthorized access to private resources, information disclosure, data manipulation, or even remote code execution. It poses a significant risk to the security and integrity of the affected web application.
To mitigate the risk, it is crucial to update Flask-Cors to version 3.0.9 or later. This version includes a fix for the insecure input handling issue. Additionally, implementing proper input validation and sanitization, as well as configuring access controls and permissions, can help reduce the risk of directory traversal attacks.
For more information about this vulnerability, you can refer to the official GitHub advisory: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-xc3p-ff3m-f46v/GHSA-xc3p-ff3m-f46v.json
Related vulnerabilities
Recent vulnerabilities recorded for flask-cors.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
