Answer in brief
CVE-2026-38360 records a Critical severity (CVSS 9.8) vulnerability in dash-uploader has a directory traversal vulnerability. The current sources do not mark it as known exploited. The current feed maps dash-uploader (pip), dash-uploader (pypi). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps dash-uploader (pip), dash-uploader (pypi). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| dash-uploaderpip | >=0.1.0,<=0.7.0a2 | Not reported |
| dash-uploaderpypi | >=0.1.0 | Not reported |
Published upstream
May 8, 2026
Evidence: source:ghsa:source_dates:source-dates:recordSource modified
Aug 31, 2026
Evidence: source:ghsa:source_dates:source-dates:recordFirst seen by HOL
Jun 11, 2026
### Impact An unauthenticated path traversal vulnerability exists in [dash-uploader](https://pypi.org/project/dash-uploader/) versions 0.1.0 through 0.7.0a2. The library's HTTP request handler at `dash_uploader/httprequesthandler.py` reads three form parameters (`upload_id`, `resumableFilename`, `resumableIdentifier`) from `request.form.get()` and passes them directly to `os.path.join()` and `os.makedirs()` without any sanitization. A single unauthenticated `POST /API/dash-uploader` request with `upload_id` set to a relative path (e.g. `../../etc/cron.d` or `../venv/lib/python3.13/site-packages`) escapes the application's `uploads/` directory and writes the supplied file content to the chosen target path under the privilege of the gunicorn / WSGI process. When the chosen target is a Python `site-packages` directory and the dropped file is a `.pth` file containing an `import`-prefixed line, Python's `site` module executes that line on the next interpreter startup, yielding remote code execution. Other escalation paths reachable from the same primitive include overwriting the running WSGI module, dropping `~/.ssh/authorized_keys`, or writing JavaScript into a Dash-served `assets/` directory for stored XSS. ### Affected versions All 16 published PyPI releases (`0.1.0` through `0.7.0a2`) are affected. The package repository was archived on 2025-07-19; **no patched version exists**. ### Mitigation Replace `dash-uploader` with an alternative file-upload component (for example, `dash-resumable-upload`, server-rendered `<input type=\"file\">` plus a hardened Flask endpoint, or a maintained Dash community alternative). There is no upstream fix path. While a replacement is being deployed, mitigations include: * Block `POST /API/dash-uploader` at an upstream proxy, OR * Run the application as an unprivileged user with no write access to its own `site-packages`, OR * Use a read-only filesystem for the application's code directories.
Quoted source text, attributed separately from HOL analysis.