GHSA-65mp-fq8v-56jr — Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection

The advisory, in context

Impact

A critical path traversal and extension bypass vulnerability in Flask-Reuploaded allows remote attackers to achieve arbitrary file write and remote code execution through Server-Side Template Injection (SSTI).

Patches

Flask-Reuploaded has been patched in version 1.5.0

Workarounds

Do not pass user input to the name parameter
Use auto-generated filenames only
Implement strict input validation if name must be used

from werkzeug.utils import secure_filename
import os

# Sanitize user input before passing to save()
safe_name = secure_filename(request.form.get('custom_name'))
# Remove path separators
safe_name = os.path.basename(safe_name)
# Validate extension matches policy
if not photos.extension_allowed(photos.get_extension(safe_name)):
    abort(400)
    
filename = photos.save(file, name=safe_name)

Resources

The fix is documented in the pull request, see https://github.com/jugmac00/flask-reuploaded/pull/180.

A proper write-up was created by the reporter of the vulnerability, Jaron Cabral (https://www.linkedin.com/in/jaron-cabral-751994357/), but is not yet available as of time of this publication.

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

flask-reuploaded PyPI

Ecosystem versions

Earlier releases before 1.5.0

Fixed in 1.5.0

10 explicitly affected versions

0.3, 0.3.1, 0.3.2, 0.4.0, 0.5.0, 1.0.0, 1.1.0, 1.2.0, 1.3.0, 1.4.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.5.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "0.3",
    "0.3.1",
    "0.3.2",
    "0.4.0",
    "0.5.0",
    "1.0.0",
    "1.1.0",
    "1.2.0",
    "1.3.0",
    "1.4.0"
  ]
}

Set up in your agent.

Investigate in your agent.

Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection