PyPI/flask-reuploaded CVE-2026-54567: high 7.5, EPSS 0.63%
Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)
Action: Upgrade flask-reuploaded to 1.6.0 or later.
pip install flask-reuploaded==1.6.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.6.0 | - |
Fixed versions
| 1.6.0 |
Sources
- osv: GHSA-937x-gpqr-72gg
- https://github.com/jugmac00/flask-reuploaded/security/advisories/GHSA-937x-gpqr-72gg
- https://github.com/jugmac00/flask-reuploaded/commit/5ded76092429c6eb8a4af941b14fbde40a38fff4
- https://github.com/jugmac00/flask-reuploaded
CVE-2026-54567 · published · modified · JSON