Arbitrary File Upload Affecting flask-reuploaded package, versions [,1.6.0)

Flask-Reuploaded is a Flexible and efficient upload handling for Flask

Affected versions of this package are vulnerable to Arbitrary File Upload through the save process when a user-supplied name parameter is used to override the filename. An attacker can upload files with dangerous extensions by manipulating the case of the file extension, thereby bypassing extension denylists and potentially achieving remote code execution on systems that treat file extensions case-insensitively. This is only exploitable if the deployment uses a denylist policy for file extensions, the application passes user-influenced values to the name parameter of save, and the server or filesystem resolves or executes file extensions in a case-insensitive manner.

• GitHub Advisory
• GitHub Commit