CVE-2026-38360 Details

A directory traversal vulnerability has been identified in fohrloop dash-uploader versions 0.1.0 through 0.7.0a2. This vulnerability allows remote attackers to execute arbitrary code by exploiting the dash_uploader/httprequesthandler.py components, specifically the BaseHttpRequestHandler.get_temp_root() and BaseHttpRequestHandler._post() methods. The vulnerability arises because user-controlled parameters are passed directly to file handling functions without proper validation, enabling attackers to manipulate file paths and execute malicious code.

Users are advised to migrate to the built-in 'dcc.Upload' component of Plotly Dash, which does not expose a filesystem-writing handler or allow client-controlled destination paths. If 'dash-uploader' must be used, place the upload endpoint behind authentication and validate the 'upload_id', 'resumableFilename', and 'resumableIdentifier' parameters against a strict allowlist. Alternatively, a custom Flask upload handler can be implemented.