CVE-2020-25032: Directory Traversal Vulnerability in Flask-CORS
Summary
CVE-2020-25032: An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9. Affects flask-cors versions < 3.0.9. Fixed in 3.0.9. How to fix ↓
Also tracked for
- python-flask-cors · Debian:11
The same CVE-2020-25032 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Flask-CORS is a middleware for Flask, a popular Python web framework. It provides Cross-Origin Resource Sharing (CORS) support, allowing web applications to make requests to a different domain. Flask-CORS helps in handling CORS headers and enforcing CORS policies. However, versions before 3.0.9 are vulnerable to a directory traversal issue that allows unauthorized access to private resources. This vulnerability occurs due to the lack of canonical format validation in resource matching.
Vulnerability Detail
The directory traversal vulnerability in Flask-CORS allows an attacker to access private resources by exploiting the resource matching mechanism. By manipulating the pathname, an attacker can bypass access restrictions and retrieve sensitive information or perform unauthorized actions. This vulnerability can lead to data leakage, privilege escalation, or unauthorized modification of resources.
How To Fix
Latest published version: 6.0.5 as of 23 Oct 2026
pip install --upgrade "flask-cors==6.0.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.0.9
This is the first release that contains the fix.
pip install --upgrade "flask-cors==3.0.9"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading Flask-CORS is not immediately feasible, a temporary workaround is to implement additional server-side checks to validate the requested resource path. This can be done by ensuring that the pathname is in a canonical format and restricting access to private resources based on a whitelist of allowed paths.
Conclusion
The directory traversal vulnerability in Flask-CORS can be mitigated by upgrading to version 3.0.9 or implementing additional server-side checks. It is crucial to address this vulnerability to prevent unauthorized access to private resources and potential data breaches. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for flask-cors →
FAQ
Flask-CORS is a middleware for Flask that provides Cross-Origin Resource Sharing (CORS) support.
Directory traversal is a vulnerability that allows an attacker to access files or directories outside of the intended scope.
This vulnerability can lead to unauthorized access to private resources, data leakage, privilege escalation, or unauthorized modification of resources.
Upgrade Flask-CORS to version 3.0.9 or later. Implement additional server-side checks if immediate upgrade is not possible.
Yes, a temporary workaround is to validate the requested resource path on the server-side and restrict access based on a whitelist of allowed paths.
Related vulnerabilities
Recent vulnerabilities recorded for flask-cors.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
