CVE-2026-54567

Flask-Reuploaded versions 1.5.0 up to (but not including) 1.6.0 inconsistently handle extension casing when saving uploads: the default upload path is lowercased, but a caller-supplied name keeps its original mixed case when checked against an AllExcept extension denylist. An attacker who can influence the saved filename can therefore store a file with a mixed-case dangerous extension (for example .PhP) that bypasses the lowercase denylist but still executes where the server resolves extensions case-insensitively. On deployments where the served upload directory can execute scripts, the stored file runs with the web server's privileges and impacts confidentiality, integrity, and availability. Applications using pure allowlists, or that never pass user-controlled values as the name override, are not affected, and path-traversal containment is not bypassed. No public proof of concept or in-the-wild exploitation is known.

What to do: Upgrade Flask-Reuploaded to 1.6.0, which fixes the case-handling bug. As defense in depth, replace AllExcept denylists with an allowlist of safe extensions, avoid passing user-controlled values to the name= override, and configure the web server so the upload directory never executes scripts (disable handler mapping for that path). Audit already-stored uploads for mixed-case dangerous extensions (e.g., .PhP, .JsP) that may have bypassed denylists.