Path Traversal in path-traversal (CVE-2026-38360, CVSS 9.8)

Summary

path traversal in path-traversal (CVE-2026-38360). Successful exploitation can lead to full system takeover.

Original description

The description as published by the source.

Impact

An unauthenticated path traversal vulnerability exists in dash-uploader versions 0.1.0 through 0.7.0a2. The library's HTTP request handler at dash_uploader/httprequesthandler.py reads three form parameters (upload_id, resumableFilename, resumableIdentifier) from request.form.get() and passes them directly to os.path.join() and os.makedirs() without any sanitization.

A single unauthenticated POST /API/dash-uploader request with upload_id set to a relative path (e.g. ../../etc/cron.d or ../venv/lib/python3.13/site-packages) escapes the application's uploads/ directory and writes the supplied file content to the chosen target path under the privilege of the gunicorn / WSGI process.

When the chosen target is a Python site-packages directory and the dropped file is a .pth file containing an import-prefixed line, Python's site module executes that line on the next interpreter startup, yielding remote code execution. Other escalation paths reachable from the same primitive include overwriting the running WSGI module, dropping ~/.ssh/authorized_keys, or writing JavaScript into a Dash-served assets/ directory for stored XSS.

Affected versions

All 16 published PyPI releases (0.1.0 through 0.7.0a2) are affected. The package repository was archived on 2025-07-19; no patched version exists.

Mitigation

Replace dash-uploader with an alternative file-upload component (for exampl…

Source: NIST National Vulnerability Database NVD GitHub Advisory

AI summary

Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.

There is a significant security risk in fohrloop's "dash-uploader" tool. Attackers could gain unauthorized access to sensitive files and install malicious code through the /Api/dash-uploader endpoint without authentication. Versions from 0.1.0 to 0.7.0a2 are affected. Since there's no fix, transitioning to secure systems like Plotly Dash's dcc.Upload is recommended.

CVE-2026-38360 is an unauthenticated path traversal vulnerability in fohrloop's dash-uploader, exploitable via GET requests. Specifically, in dash_uploader/httprequesthandler.py, request parameters like upload_id, resumableFilename, and resumableIdentifier are improperly sanitized before being passed to os.path.join and os.makedirs, allowing directory traversal. Versions affected are from v0.1.0 to v0.7.0a2, and there is no patch available. It is recommended to stop using it and transition to dcc.Upload component.

❓ What is the problem

Directory Traversal vulnerability in fohrloop's dash-uploader

📍 Affected scope

GET /Api/dash-uploader endpoint, dash_uploader/httprequesthandler.py file

🔥 Severity

Critical; allows unauthenticated remote code execution

🔧 How to fix

Migrate to Plotly Dash's dcc.Upload component

🛡️ Workaround

No patch available; recommended to migrate components

🔍 Detection

Check system logs for unauthorized file access patterns in dash-uploader endpoints

Related past incidents Similar incidents extracted from past CVEs

CVE-2026-38361

DoS vulnerability in the same dash-uploader library, indicating potential for further exploits within the same ecosystem.

If this happens at your company Expected impact per business scenario

📌 ECサイトのシステムにdash-uploaderが組み込まれている場合

攻撃者がシステムに不正なコードを注入し、顧客データが漏えいする可能性があります。

📌 社内のファイル共有サーバーにdash-uploaderが使用されている場合

社内業務のデータが削除されたり、不正にアクセスされるリスクが高まります。

📌 公的機関のデジタルインフラにdash-uploaderが導入されている場合

機密文書や機関データに不正アクセスが可能になり、社会的混乱が引き起こされる可能性があります。

Recommended action

直ちにdash-uploaderの使用を中止し、Plotly Dashのddc.Uploadコンポーネントへの移行を検討することを強く推奨します。

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

1
Identify exposure identify
```
grep -r 'path-traversal' . | grep -v node_modules
```
リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で path-traversal を grep し、稼働しているサービス・バージョンを把握する。
7
Post-deployment verification verify
```
Confirm patched version is live in production
```
パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 3 と同じログクエリでアラート再発が無いか継続監視。

Affected packages

pip dash-uploader

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

PyPI dash-uploader

[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.0"},{"last_affected":"0.7.0a2"}]}]

References

advisory nvd.nist.gov
package github.com
package github.com
web github.com
web github.com
web github.com
web github.com
web cve@mitre.org
web pypi.org
web github.com
web github.com
web github.com