What are the best solutions to replace dash-uploader?

Lucas Boucinha (snps)

Hi guys,

I've just watched the last SAF AFT meeting and discovered the vulnerability issue with dash-uploader.

I'm using it in my solution and so I'm looking for a replacement.

Copilot advised me to replace it with dcc.Upload component but also said large file support will cause browser/memory issues.

End-users of my solution possibly upload files bigger than 10GB. So I'm not sure I should go with dcc.Upload.

As anyone found a replacement of dash-uploader that would work fine with large files?

@Ismael Azehaf any suggestions?

Ismael Azehaf

Hi @Lucas Boucinha (snps)

As of now, there are no component to replace dash uploader. There is a research work in progress though. We will communicate as soon as possible.

That being said, CVE-2026-38360 which is affecting dash uploader is not critical on desktop deployments where the Dash server is bound to 127.0.0.1 / localhost. However it is critical in on-premises deployments.

So if you are in a desktop configuration, you can continue to use dash uploader and bypass this CVE until we come up with a sustainable solution.