| Package | Affected versions | Patched versions |
|---|---|---|
| flask-reuploaded | < 1.5.0 | 1.5.0 |
| flask-reuploaded | < 1.5.0 | 1.5.0 |
A critical path traversal and extension bypass vulnerability in Flask-Reuploaded allows remote attackers to achieve arbitrary file write and remote code execution through Server-Side Template Injection (SSTI).
Flask-Reuploaded has been patched in version 1.5.0
name parametername must be usedfrom werkzeug.utils import secure_filename
import os
# Sanitize user input before passing to save()
safe_name = secure_filename(request.form.get('custom_name'))
# Remove path separators
safe_name = os.path.basename(safe_name)
# Validate extension matches policy
if not photos.extension_allowed(photos.get_extension(safe_name)):
abort(400)
filename = photos.save(file, name=safe_name)
The fix is documented in the pull request, see https://github.com/jugmac00/flask-reuploaded/pull/180.
A proper write-up was created by the reporter of the vulnerability, Jaron Cabral (https://www.linkedin.com/in/jaron-cabral-751994357/), but is not yet available as of time of this publication.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free