Unrated

Extension denylist bypass in Flask-Reuploaded UploadSet.save

IdentifiersCVE-2026-54567CWE-178

CVE-2026-54567 is an extension validation bypass in Flask-Reuploaded affecting the UploadSet.save(storage, name=...) code path when an overridden filename is supplied through the name parameter. The flaw stems from case-folding asymmetry in validation of the overridden basename extension: denylist checks can be performed inconsistently with respect to letter case, allowing dangerous extensions in mixed-case forms to evade policy enforcement. As a result, files with extensions that should be blocked can be accepted and stored when the attacker can influence the overridden filename. This issue is described as an incomplete-fix variant of CVE-2026-27641.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an attacker to bypass denylist-based upload restrictions and store files using prohibited extensions in mixed-case variants. In environments where the web stack, application server, or downstream processing treats file extensions case-insensitively, the uploaded file may still be interpreted as executable server-side content. In such deployments, the vulnerability can result in remote code execution with the privileges of the web server or application process. Even where code execution is not achieved, it can still permit storage of disallowed content and weaken upload security controls.

Mitigation

If you can’t patch tonight, do this now.

Do not rely on denylist-only upload validation. Use strict allowlists for permitted file types and avoid passing user-influenced values into UploadSet.save(..., name=...). Store uploaded content outside web-accessible or execution-capable directories, and configure the server so uploaded files cannot be executed as active content. Where feasible, add independent content-type and file-signature validation to reduce reliance on filename extensions alone.

Remediation

Patch, then assume compromise.

Upgrade Flask-Reuploaded to version 1.6.0 or later. If a vendor patch cannot be applied immediately, correct the validation logic so that the overridden basename extension is normalized before policy evaluation, for example by lowercasing the extracted extension prior to denylist or allowlist checks and before save operations. Validation helpers and policy containers should be made case-insensitive so that extension handling is consistent across all code paths, including name overrides.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

ACTIVITY FEED

Recent activity

No public activity tracked yet. Mallory keeps watching.

0 SOURCESView more in app

No public activity observed for this vulnerability.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity