The vulnerability originates from a server‑side template injection in the file upload component of Flask‑Reuploaded. An attacker who can supply a malicious template via the name parameter during a file upload can write arbitrary files to the server’s filesystem and execute code. The flaw is a critical path traversal combined with an extension bypass, allowing the attacker to choose the location and filename of a written file. This results in a full remote code execution capability, granting the attacker control over the affected system. The weakness maps to CWE‑1336 for template injection and CWE‑22 for path traversal.

The affected product is Flask‑Reuploaded by jugmac00. Versions earlier than 1.5.0 are impacted. All deployments of Flask‑Reuploaded prior to the 1.5.0 release that use the name parameter for user‑supplied filenames are vulnerable.

The CVSS score of 9.8 indicates critical severity. While the EPSS score is less than 1%, indicating a low measured exploit probability, the high impact renders this flaw a top priority for remediation. The vulnerability is not listed in CISA’s KEV catalog, but the combination of remote triggerability and full code execution warrants immediate attention. The likely attack path involves an attacker uploading a crafted file through the web interface, with the name parameter exploited to inject template code and write files to arbitrary locations.