Paper/Archive/CVE-2026-38360

CVE-2026-38360

mitre — Directory Traversal vulnerability in fohrloop dash-uploader v.0.1.0 through v.0.7.0a2 allows a remote attacker to execute arbitrary code…

EPSS 6%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 93.3.933 × 2018.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Directory Traversal vulnerability in fohrloop dash-uploader v.0.1.0 through v.0.7.0a2 allows a remote attacker to execute arbitrary code via the dash_uploader/httprequesthandler.py, BaseHttpRequestHandler.get_temp_root(), BaseHttpRequestHandler._post() components.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/fohrloop/dash-uploader refpypi.org/project/dash-uploader refgithub.com/fohrloop/dash-uploader/blob/stable/dash_uploader/httprequesthandler.py refgithub.com/fohrloop/dash-uploader/blob/dev/dash_uploader/httprequesthandler.py refgithub.com/fohrloop/dash-uploader/issues/153 refgithub.com/a1ohadance/CVE-2026-38360 refgithub.com/github/advisory-database/pull/7635 refgithub.com/advisories/GHSA-3rf6-x59v-5jfv