dash-uploader CVE-2026-38360

No special conditions - remote unauthenticated exploitation against default configurations of dash-uploader. The CVSS vector AV:N/AC:L/PR:N/UI:N indicates attackers require only network access to the Dash application's upload endpoint with no authentication, complex timing, or race conditions. Exploitation succeeds against any dash-uploader deployment (versions 0.1.0-0.7.0a2) that exposes file upload functionality via HTTP/HTTPS. The primary limiting factor is deployment prevalence: only Plotly Dash web applications that have integrated the dash-uploader package and published upload endpoints are vulnerable. Applications not using dash-uploader or those where upload endpoints are not network-accessible (e.g., internal-only admin interfaces behind authentication layers not implemented by dash-uploader itself) have reduced attack surface. However, dash-uploader is designed for user-facing file uploads, so typical deployments are inherently exposed.

The CVSS 9.8 critical rating accurately reflects severe real-world risk: network vector (AV:N) with low complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N) creates a trivially exploitable attack surface. High impact across confidentiality, integrity, and availability (C:H/I:H/A:H) aligns with RCE capability. Public exploit code exists at github.com/a1ohadance/CVE-2026-38360, significantly lowering attacker skill requirements and increasing likelihood of automated scanning. However, risk is constrained to environments actively deploying dash-uploader in production Dash applications with exposed upload endpoints - this is not a ubiquitous library like requests or Flask. EPSS score unavailable at time of analysis, and no CISA KEV listing suggests exploitation may be targeted rather than widespread automated campaigns. The vulnerability is automatable (SSVC) given the network vector and public POC, with technical impact of total system compromise if the web application runs with elevated privileges. Organizations not using dash-uploader have zero exposure. For affected deployments, this is a drop-everything-and-patch scenario given the combination of critical CVSS, public exploit, and RCE impact.

An unauthenticated remote attacker identifies a web application using dash-uploader by fingerprinting Dash framework upload endpoints (typically via HTTP POST to configured upload routes). The attacker crafts a malicious HTTP POST request with path traversal sequences (e.g., '../../../tmp/malicious.py' or '../../var/www/html/shell.php') in filename parameters processed by BaseHttpRequestHandler._post(). The vulnerable get_temp_root() and _post() methods fail to sanitize input, writing attacker-controlled content to arbitrary filesystem paths. By uploading a web shell to a publicly accessible directory or overwriting application configuration files, the attacker achieves remote code execution with privileges of the web application process, enabling data exfiltration, lateral movement, or complete system compromise. Public POC at github.com/a1ohadance/CVE-2026-38360 provides ready-made exploitation tools.