CVE-2026-27641 Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection
Remote attackers can achieve arbitrary file write and remote code execution via Server-Side Template Injection in Flask-Reuploaded.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-27641?
CVE-2026-27641 is a critical code injection vulnerability in jugmac00 flask-reuploaded, published on 25 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Flask-Reuploaded provides file uploads for Flask. A critical path traversal and extension bypass vulnerability in versions prior to 1.5.0 allows remote attackers to achieve arbitrary file write and remote code execution through Server-Side Template Injection (SSTI). Flask-Reuploaded has been patched in version 1.5.0. Some workarounds are available. Do not pass user input to the `name` parameter, use auto-generated filenames only, and implement strict input validation if `name` must be used.
Which versions are affected by CVE-2026-27641?
3 open source packages ship an affected version, including flask-reuploaded. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
flask-reuploaded PyPI | All versions | 1.5.0 |
flask-reuploaded PyPI | All versions | 1.5.0 |
flask-reuploaded PyPI | All versions | 1.5.0 |
Products include Jugmac00 Flask-Reuploaded.
How do I fix CVE-2026-27641?
Upgrade flask-reuploaded to 1.5.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-27641 being exploited?
There is no known exploitation of CVE-2026-27641 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-65mp-fq8v-56jr, PYSEC-2026-341.