CVE-2026-54567

Name of the Vulnerable Software and Affected Versions Flask-Reuploaded versions prior to 1.5.1

Description An issue exists in the UploadSet.save() function where the name parameter can be used to bypass extension denylists. When a user provides a name override, the system performs re-validation using a case-preserving extension() helper instead of the case-normalizing lowercase ext() helper used in the default upload path. This asymmetry allows attackers to upload files with denied extensions by using mixed-case filenames (e.g., shell.PHP or evil.pHp), as the check against the lowercase denylist returns true for uppercase variants. On servers that execute files case-insensitively, such as those on Windows, macOS, or specific Apache configurations, this can lead to remote code execution.

Recommendations For versions prior to 1.5.1, normalize the extension to lowercase before the policy check by using extension(basename).lower() or lowercase ext(basename) within the UploadSet.save() function. As a temporary mitigation, avoid passing user-influenced values to the name parameter in the save() function.