CVE-2026-38361

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-38361
An issue in fohrloop dash-uploader v.0.1.0 through v.0.7.0a2 allows a remote attacker to execute arbitrary code via the dash_uploader/httprequesthandler.py, dash_uploader/upload.py in the Upload function and max_file_size parameter, dash_uploader/configure_upload.py components

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://docs.python.org/3/library/functions.html#all Product
https://github.com/a1ohadance/CVE-2026-38361 Exploit Third Party Advisory
https://github.com/fohrloop/dash-uploader Product
https://github.com/fohrloop/dash-uploader/blob/stable/dash_uploader/httprequesthandler.py Product
https://github.com/fohrloop/dash-uploader/issues/153 Product
https://libraries.io/pypi/dash-uploader Product
https://pepy.tech/project/dash-uploader Product
https://pypi.org/project/dash-uploader/ Product
https://pypistats.org/packages/dash-uploader Product
https://github.com/a1ohadance/CVE-2026-38361 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:fohrloop:dash-uploader:*:*:*:*:*:python:*:*
cpe:2.3:a:fohrloop:dash-uploader:0.7.0:alpha1:*:*:*:python:*:*
cpe:2.3:a:fohrloop:dash-uploader:0.7.0:alpha2:*:*:*:python:*:*
History

12 May 2026, 20:55

Type Values Removed Values Added
References () https://docs.python.org/3/library/functions.html#all - () https://docs.python.org/3/library/functions.html#all - Product
References () https://github.com/a1ohadance/CVE-2026-38361 - () https://github.com/a1ohadance/CVE-2026-38361 - Exploit, Third Party Advisory
References () https://github.com/fohrloop/dash-uploader - () https://github.com/fohrloop/dash-uploader - Product
References () https://github.com/fohrloop/dash-uploader/blob/stable/dash_uploader/httprequesthandler.py - () https://github.com/fohrloop/dash-uploader/blob/stable/dash_uploader/httprequesthandler.py - Product
References () https://github.com/fohrloop/dash-uploader/issues/153 - () https://github.com/fohrloop/dash-uploader/issues/153 - Product
References () https://libraries.io/pypi/dash-uploader - () https://libraries.io/pypi/dash-uploader - Product
References () https://pepy.tech/project/dash-uploader - () https://pepy.tech/project/dash-uploader - Product
References () https://pypi.org/project/dash-uploader/ - () https://pypi.org/project/dash-uploader/ - Product
References () https://pypistats.org/packages/dash-uploader - () https://pypistats.org/packages/dash-uploader - Product
First Time Fohrloop
Fohrloop dash-uploader
CPE cpe:2.3:a:fohrloop:dash-uploader:*:*:*:*:*:python:*:*
cpe:2.3:a:fohrloop:dash-uploader:0.7.0:alpha1:*:*:*:python:*:*
cpe:2.3:a:fohrloop:dash-uploader:0.7.0:alpha2:*:*:*:python:*:*
CWE NVD-CWE-noinfo

08 May 2026, 19:16

Type Values Removed Values Added
CWE CWE-670
CWE-400
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
References () https://github.com/a1ohadance/CVE-2026-38361 - () https://github.com/a1ohadance/CVE-2026-38361 -

08 May 2026, 15:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-05-08 15:16

Updated : 2026-05-12 20:55

NVD link : CVE-2026-38361

Mitre link : CVE-2026-38361

CVE.ORG link : CVE-2026-38361

JSON object : View

Products Affected

fohrloop

  • dash-uploader
CWE
NVD-CWE-noinfo CWE-400

Uncontrolled Resource Consumption

CWE-670

Always-Incorrect Control Flow Implementation