dash-uploader 0.1.0 - 0.7.0a2 - Denial-of-Service via flowTotalChunks

highseverity

7.5CVSS score

2.6%likelihood of exploitation, next 30 days

86%of all CVEs are less likely

Readycheck to confirm it

fohrloop dash-uploader v0.1.0 through v0.7.0a2 contains a remote code execution caused by improper handling in Upload function and max_file_size parameter in dash_uploader components, letting remote attackers execute arbitrary code, exploit requires crafted request.

Impact

Remote attackers can execute arbitrary code, potentially leading to full system compromise.

Fix

Update to the latest version beyond v0.7.0a2.

How to confirm it

Send: GET {{BaseURL}}
Positive when: status_code == 200 and contains(body, "dash_uploader")

Run it with nuclei: nuclei -id CVE-2026-38361 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2026-38361

info:
  name: dash-uploader 0.1.0 - 0.7.0a2 - Denial-of-Service via flowTotalChunks
  author: a1ohadance
  severity: high
  description: |
   fohrloop dash-uploader v0.1.0 through v0.7.0a2 contains a remote code execution caused by improper handling in Upload function and max_file_size parameter in dash_uploader components, letting remote attackers execute arbitrary code, exploit requires crafted request.
  impact: |
   Remote attackers can execute arbitrary code, potentially leading to full system compromise.
  remediation: |
   Update to the latest version beyond v0.7.0a2.
  reference:
    - https://github.com/a1ohadance/CVE-2026-38361
    - https://nvd.nist.gov/vuln/detail/CVE-2026-38361
    - https://github.com/advisories/GHSA-xp7f-v245-w3w8
    - https://github.com/fohrloop/dash-uploader/issues/153
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2026-38361
    epss-score: 0.02643
    epss-percentile: 0.85719
    cwe-id: CWE-400
  metadata:
    verified: false
    max-request: 1
    vendor: fohrloop
    product: dash-uploader
    shodan-query: html:"_dash-undo-redo"
    fofa-query: body="_dash-undo-redo"
  tags: cve,cve2026,dash-uploader,unauth,python,passive

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "dash_uploader")'
        condition: and

    extractors:
      - type: regex
        part: body
        group: 1
        regex:
          - 'dash_uploader\.v([0-9._a-z-]+?)m[0-9]+\.min\.js'

References

Use this check only on systems you are authorised to test. Where the data comes from