CVE-2026-38360: dash-uploader has a directory traversal vulnerability

An unauthenticated path traversal vulnerability exists in dash-uploader versions 0.1.0 through 0.7.0a2. The library’s HTTP request handler at dash_uploader/httprequesthandler.py reads three form parameters (upload_id, resumableFilename, resumableIdentifier) from request.form.get() and passes them directly to os.path.join() and os.makedirs() without any sanitization.

A single unauthenticated POST /API/dash-uploader request with upload_id set to a relative path (e.g. ../../etc/cron.d or ../venv/lib/python3.13/site-packages) escapes the application’s uploads/ directory and writes the supplied file content to the chosen target path under the privilege of the gunicorn / WSGI process.

When the chosen target is a Python site-packages directory and the dropped file is a .pth file containing an import-prefixed line, Python’s site module executes that line on the next interpreter startup, yielding remote code execution. Other escalation paths reachable from the same primitive include overwriting the running WSGI module, dropping ~/.ssh/authorized_keys, or writing JavaScript into a Dash-served assets/ directory for stored XSS.