Technical impact
The vulnerability resides in the chunked‑upload handler of fohrloop dash‑uploader. Unsanitized upload parameters such as flowTotalChunks are accepted and not bounded by the documented max_file_size. A crafted request that supplies an excessively large or zero value for flowTotalChunks triggers an unbounded loop in a list comprehension, exhausting memory and causing the process to crash. The handler also permanently stores temporary uploads in per‑flowIdentifier directories that are never removed, leading to disk exhaustion. Additionally, a zero‑chunk value can cause the target file to be truncated to zero bytes. These behaviors allow a remote, unauthenticated attacker to cause denial‑of‑service, data loss, and potentially compromise the integrity of stored files.
Affected Systems
fohrloop dash‑uploader versions 0.1.0 through 0.7.0a2. No specific vendor name listed, but the product is the Python‑based dash‑uploader package distributed via PyPI.
Risk and Exploitability
Based on the description, the likely attack vector is a crafted HTTP POST request to the upload endpoint that supplies an invalid flowTotalChunks value—such as an excessively large or zero number—to trigger the unbounded loop or truncation behavior. The flaw resides in the core upload handling logic; no authentication or additional privileges are required, so the vulnerability is broadly exploitable. The entry carries a CVSS score of 7.5, an EPSS score of 3%, and is not listed in the CISA KEV catalog, indicating a high severity flaw.
