Critical severity9.8NVD Advisory· Published May 8, 2026· Updated May 12, 2026

CVE-2026-38360

Description

Directory Traversal vulnerability in fohrloop dash-uploader v.0.1.0 through v.0.7.0a2 allows a remote attacker to execute arbitrary code via the dash_uploader/httprequesthandler.py, aseHttpRequestHandler.get_temp_root(), BaseHttpRequestHandler._post() components

Affected products

Pachno/Dash Uploaderreferences
Package: https://pypi.org/project/dash-uploader

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

github.com/fohrloop/dash-uploader/blob/dev/dash_uploader/httprequesthandler.pynvd
github.com/fohrloop/dash-uploader/blob/stable/dash_uploader/httprequesthandler.pynvd
github.com/fohrloop/dash-uploader/issues/153nvd
pypi.org/project/dash-uploader/nvd

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.014
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000