An flaw in fohrloop dash-uploader allows a remote attacker to execute arbitrary code by exploiting the Upload function and the max_file_size parameter within the dash_uploader/httprequesthandler.py component. The vulnerability enables the attacker to supply malicious content that is processed and executed by the server, compromising both confidentiality and integrity of the hosting system. This can lead to complete takeover of the application or the underlying host.

fohrloop dash-uploader versions 0.1.0 through 0.7.0a2. No specific vendor name is listed, but the product is the Python-based dash-uploader package distributed via PyPI.

The CVE carries a CVSS score of 7.5, lacks an EPSS score, and is not listed in the CISA KEV catalog, indicating a high severity flaw. Based on the description, the likely attack vector is a crafted HTTP POST request to the upload endpoint that includes a malicious payload and an oversized max_file_size parameter. Because the flaw resides in the core upload handling logic, successful exploitation does not require additional privileges, making the vulnerability broadly exploitable.