Flask-Reuploaded versions prior to 1.5.0 contain a critical vulnerability allowing remote code execution via Server-Side Template Injection (SSTI). This flaw involves path traversal and extension bypass, enabling attackers to write arbitrary files. The issue is fixed in version 1.5.0. Mitigations include avoiding user input in the 'name' parameter, using auto-generated filenames, or applying strict input validation and sanitization.