EUVD-2026-28645
GHSA-xp7f-v245-w3w8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
An issue in fohrloop dash-uploader v.0.1.0 through v.0.7.0a2 allows a remote attacker to execute arbitrary code via the dash_uploader/httprequesthandler.py, dash_uploader/upload.py in the Upload function and max_file_size parameter, dash_uploader/configure_upload.py components
AnalysisAI
Remote code execution and denial-of-service in dash-uploader Python library allows unauthenticated network attackers to execute arbitrary code or crash applications via malicious file uploads. Versions 0.1.0 through 0.7.0a2 contain flaws in HTTP request handler (httprequesthandler.py), upload function (upload.py), and max_file_size parameter processing (configure_upload.py). Confirmed public exploit code exists (GitHub: a1ohadance/CVE-2026-38361), elevating risk despite CVSS indicating only availability impact - the RCE tag contradicts the CVSS vector's C:N/I:N rating, suggesting incomplete impact assessment. EPSS data unavailable; not in CISA KEV at time of analysis. Affects popular Python file upload component with thousands of monthly downloads per PyPI statistics.
Technical ContextAI
Dash-uploader is a Python library for Plotly Dash applications providing resumable file upload capabilities. The vulnerability affects core upload processing components: the HTTP request handler that receives uploaded files, the Upload function managing upload logic, and the max_file_size parameter validation in configure_upload.py. The CWE-400 classification (Uncontrolled Resource Consumption) typically indicates insufficient input validation allowing resource exhaustion attacks, but the RCE tag suggests additional code injection vectors beyond simple DoS. The affected codebase processes user-controlled file upload data without adequate sanitization, potentially allowing malicious payloads in file metadata, filenames, or upload parameters to trigger arbitrary code execution or consume excessive system resources. Python's dynamic nature and the library's direct handling of HTTP requests create multiple attack surfaces for both availability and integrity impacts.
RemediationAI
No vendor-released patch version identified at time of analysis. Monitor GitHub repository (github.com/fohrloop/dash-uploader) for security updates and review issue #153 (github.com/fohrloop/dash-uploader/issues/153) for vendor acknowledgment and remediation timeline. Upstream fix may exist post-0.7.0a2 but released patched version not independently confirmed from provided data. Immediate compensating controls: (1) Implement strict application-layer file upload validation before passing to dash-uploader - validate file types, sizes, names using allowlists, not the library's max_file_size alone (trade-off: development effort, potential upload feature limitations). (2) Deploy dash-uploader functionality behind authentication and authorization controls to eliminate unauthenticated remote attack vector (trade-off: changes user workflow if uploads were public-facing). (3) Run Dash applications with minimal filesystem and network privileges using dedicated service accounts to limit RCE impact scope (trade-off: deployment complexity, potential compatibility issues). (4) Monitor upload endpoints for anomalous traffic patterns including oversized requests, unusual file extensions, or rapid repeated uploads (trade-off: operational overhead, false positives). (5) Consider temporarily disabling upload functionality if not business-critical until vendor patch available (trade-off: feature unavailability). Review Python environment hardening per docs.python.org/3/library/functions.html for additional defense-in-depth.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allShare
External POC / Exploit Code
Leaving vuln.today