GHSA-3RF6-X59V-5JFV

Vulnerability from github – Published: 2026-05-08 18:31 – Updated: 2026-06-08 17:52
VLAI
Summary
dash-uploader has a directory traversal vulnerability
Details

Impact

An unauthenticated path traversal vulnerability exists in dash-uploader versions 0.1.0 through 0.7.0a2. The library's HTTP request handler at dash_uploader/httprequesthandler.py reads three form parameters (upload_id, resumableFilename, resumableIdentifier) from request.form.get() and passes them directly to os.path.join() and os.makedirs() without any sanitization.

A single unauthenticated POST /API/dash-uploader request with upload_id set to a relative path (e.g. ../../etc/cron.d or ../venv/lib/python3.13/site-packages) escapes the application's uploads/ directory and writes the supplied file content to the chosen target path under the privilege of the gunicorn / WSGI process.

When the chosen target is a Python site-packages directory and the dropped file is a .pth file containing an import-prefixed line, Python's site module executes that line on the next interpreter startup, yielding remote code execution. Other escalation paths reachable from the same primitive include overwriting the running WSGI module, dropping ~/.ssh/authorized_keys, or writing JavaScript into a Dash-served assets/ directory for stored XSS.

Affected versions

All 16 published PyPI releases (0.1.0 through 0.7.0a2) are affected. The package repository was archived on 2025-07-19; no patched version exists.

Mitigation

Replace dash-uploader with an alternative file-upload component (for example, dash-resumable-upload, server-rendered <input type=\"file\"> plus a hardened Flask endpoint, or a maintained Dash community alternative). There is no upstream fix path.

While a replacement is being deployed, mitigations include:

  • Block POST /API/dash-uploader at an upstream proxy, OR
  • Run the application as an unprivileged user with no write access to its own site-packages, OR
  • Use a read-only filesystem for the application's code directories.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "dash-uploader"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.1.0"
            },
            {
              "last_affected": "0.7.0a2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-38360"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-08T17:52:29Z",
    "nvd_published_at": "2026-05-08T17:16:30Z",
    "severity": "CRITICAL"
  },
  "details": "### Impact\n\nAn unauthenticated path traversal vulnerability exists in [dash-uploader](https://pypi.org/project/dash-uploader/) versions 0.1.0 through 0.7.0a2. The library\u0027s HTTP request handler at `dash_uploader/httprequesthandler.py` reads three form parameters (`upload_id`, `resumableFilename`, `resumableIdentifier`) from `request.form.get()` and passes them directly to `os.path.join()` and `os.makedirs()` without any sanitization.\n\nA single unauthenticated `POST /API/dash-uploader` request with `upload_id` set to a relative path (e.g. `../../etc/cron.d` or `../venv/lib/python3.13/site-packages`) escapes the application\u0027s `uploads/` directory and writes the supplied file content to the chosen target path under the privilege of the gunicorn / WSGI process.\n\nWhen the chosen target is a Python `site-packages` directory and the dropped file is a `.pth` file containing an `import`-prefixed line, Python\u0027s `site` module executes that line on the next interpreter startup, yielding remote code execution. Other escalation paths reachable from the same primitive include overwriting the running WSGI module, dropping `~/.ssh/authorized_keys`, or writing JavaScript into a Dash-served `assets/` directory for stored XSS.\n\n### Affected versions\n\nAll 16 published PyPI releases (`0.1.0` through `0.7.0a2`) are affected. The package repository was archived on 2025-07-19; **no patched version exists**.\n\n### Mitigation\n\nReplace `dash-uploader` with an alternative file-upload component (for example, `dash-resumable-upload`, server-rendered `\u003cinput type=\\\"file\\\"\u003e` plus a hardened Flask endpoint, or a maintained Dash community alternative). There is no upstream fix path.\n\nWhile a replacement is being deployed, mitigations include:\n\n* Block `POST /API/dash-uploader` at an upstream proxy, OR\n* Run the application as an unprivileged user with no write access to its own `site-packages`, OR\n* Use a read-only filesystem for the application\u0027s code directories.",
  "id": "GHSA-3rf6-x59v-5jfv",
  "modified": "2026-06-08T17:52:29Z",
  "published": "2026-05-08T18:31:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-38360"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fohrloop/dash-uploader/issues/153"
    },
    {
      "type": "WEB",
      "url": "https://github.com/a1ohadance/CVE-2026-38360"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fohrloop/dash-uploader"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fohrloop/dash-uploader/blob/dev/dash_uploader/httprequesthandler.py"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fohrloop/dash-uploader/blob/stable/dash_uploader/httprequesthandler.py"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/lmigtech/dash_uploader"
    },
    {
      "type": "WEB",
      "url": "https://pypi.org/project/dash-uploader"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "dash-uploader has a directory traversal vulnerability"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.