Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

flask-reuploaded

2 known vulnerabilities (1 critical, 1 high), with the versions each affects and the releases that fix them.

Latest release
1.6.0 (Jun 6, 2026): no advisory affects it
Newest unaffected release
1.6.0 (Jun 6, 2026), the latest release
Advisories
2 · 1 critical, 1 high
Weekly downloads
3,198
Dependents
3
Releases
12 since 0.3.0 (Jun 27, 2020)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 2

  • Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)

    Affected: fixed in 1.6.0.

    Fixed in 1.6.0 (released Jun 6, 2026, 100 days before disclosure).

    The latest release, 1.6.0, is not affected.

  • CVE-2026-27641Critical 9.8

    Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection

    Affected: fixed in 1.5.0.

    Fixed in 1.5.0 (released Feb 21, 2026, 4 days before disclosure).

    The latest release, 1.6.0, is not affected.