CVE-2024-6866 Case-Insensitive Path Matching in corydolphin/flask-cors
Case-insensitive path matching in flask-cors allows unauthorized origins to access restricted paths, leading to data exposure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-6866?
CVE-2024-6866 is a medium-severity vulnerability in corydolphin/flask-cors, published on 20 Mar 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
corydolphin/flask-cors version 4.01 contains a vulnerability where the request path matching is case-insensitive due to the use of the `try_match` function, which is originally intended for matching hosts. This results in a mismatch because paths in URLs are case-sensitive, but the regex matching treats them as case-insensitive. This misconfiguration can lead to significant security vulnerabilities, allowing unauthorized origins to access paths meant to be restricted, resulting in data exposure and potential data leaks.
Weakness: CWE-178
Which versions are affected by CVE-2024-6866?
3 open source packages ship an affected version, including flask-cors. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
flask-cors PyPI | All versions | 6.0.0 |
flask-cors PyPI | All versions | 6.0.0 |
flask-cors PyPI | All versions | 6.0.0 |
Products include Flask-Cors Project Flask-Cors.
How do I fix CVE-2024-6866?
Upgrade flask-cors to 6.0.0 or later.
Is CVE-2024-6866 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-6866 exists.
Other vulnerabilities in corydolphin/flask-cors
Sources
Also known as CLSA-2025-1759882315, DEBIAN-CVE-2024-6866, ECHO-d5f7-cb8c-2a12, GHSA-43qf-4rqw-9q2g, PYSEC-2026-1383, ROOT-APP-PYPI-CVE-2024-6866 and 1 more.