CVE-2026-38360: dash-uploader has a directory traversal vulnerability

Should you act?

Critical and remotely reachable

No known exploitation yet, but it is network-reachable without credentials. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

• No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
• EPSS 6.1%, percentile 93: FIRST’s model estimates a 6.1% chance of exploitation activity in the next 30 days, higher than 93% of all scored CVEs (elevated). EPSS is a probability, not a verdict.
• Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
• Only applies if your dependency tree includes dash-uploader (PyPI) >= 0.1.0, <= 0.7.0a2, no fixed version listed. Check your lockfile, including transitive dependencies.

What it is

Directory Traversal vulnerability in fohrloop dash-uploader v.0.1.0 through v.0.7.0a2 allows a remote attacker to execute arbitrary code via the dashuploader/httprequesthandler.py, BaseHttpRequestHandler.gettemproot(), BaseHttpRequestHandler.post() components.

From the GitHub advisory

Impact

An unauthenticated path traversal vulnerability exists in dash-uploader versions 0.1.0 through 0.7.0a2. The library's HTTP request handler at dashuploader/httprequesthandler.py reads three form parameters (uploadid, resumableFilename, resumableIdentifier) from request.form.get() and passes them directly to os.path.join() and os.makedirs() without any sanitization.

A single unauthenticated POST /API/dash-uploader request with uploadid set to a relative path (e.g. ../../etc/cron.d or ../venv/lib/python3.13/site-packages) escapes the application's uploads/ directory and writes the supplied file content to the chosen target path under the privilege of the gunicorn / WSGI process.

When the chosen target is a Python site-packages directory and the dropped file is a .pth file containing an import-prefixed line, Python's site module executes that line on the next interpreter startup, yielding remote code execution. Other escalation paths reachable from the same primitive include overwriting the running WSGI module, dropping ~/.ssh/authorizedkeys, or writing JavaScript into a Dash-served assets/ directory for stored XSS.

Affected versions

Weakness type: CWE-22.

Product: dash-uploader (PyPI) · Assigned by: mitre · Published: 2026-05-08

Affected and fixed versions

Severity scores

• Attack vector: network (remotely reachable)
• Attack complexity: low
• Privileges required: none (no login)
• User interaction: none
• Scope: unchanged

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

• CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
• CISA SSVC assessment: exploitation none, automatable yes, technical impact total.
• FIRST EPSS (model of 2026-10-21): 6.14% probability of exploitation activity in the next 30 days; percentile 93.

Timeline

• 2026-05-08 — CVE record published by mitre
• 2026-05-08 — GitHub-reviewed advisory GHSA-3rf6-x59v-5jfv published (critical)
• 2026-06-10 — CVE record last updated

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vulnerability records

1. GitHub Advisory GHSA-3rf6-x59v-5jfv github.com
2. CVE.org record CVE-2026-38360 cve.org
3. NVD entry CVE-2026-38360 nvd.nist.gov

Other references from the CVE record and advisory

1. github.com github.com
2. pypi.org pypi.org
3. github.com github.com
4. github.com github.com
5. github.com github.com
6. github.com github.com
7. github.com github.com
8. github.com github.com

Critical PyPI advisories · Today’s Security Digest