Flask-Reuploaded versions from 1.5.0 up to but not including 1.6.0 have a vulnerability in the UploadSet.save function where the default upload path extension is converted to lowercase, but a caller-supplied filename's extension preserves case before being checked against an AllExcept denylist. This discrepancy allows an attacker controlling the filename override to use mixed-case extensions to bypass the denylist and upload files with dangerous extensions. Exploitation requires a denylist configuration, user-influenced filename override, and a deployment environment that treats extensions case-insensitively. If the upload directory is execution-capable, the attacker can execute arbitrary files with the web server's privileges, affecting confidentiality, integrity, and availability. The vulnerability is addressed in flask-reuploaded version 1.6.0.

An attacker who can control the filename override and exploit this vulnerability can bypass a lowercase denylist to upload files with dangerous extensions in mixed case. If the upload directory allows execution, these files can run with the web server's privileges, potentially compromising system confidentiality, integrity, and availability. Pure allowlist configurations and path containment protections are not bypassed by this issue.

Upgrade flask-reuploaded to version 1.6.0 or later, where this vulnerability is fixed. Until then, avoid configurations that rely solely on lowercase denylist checks for file extensions and ensure that upload directories do not allow execution of uploaded files. Patch status is confirmed fixed in version 1.6.0.