CVE-2026-24486
HIGH
GHSA-wp53-j4wj-2cfg
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Lifecycle Timeline
4Description
Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename. Users should upgrade to version 0.0.22 to receive a patch or, as a workaround, avoid using `UPLOAD_KEEP_FILENAME=True` in project configurations.
Analysis
Arbitrary file write in Python-Multipart versions before 0.0.22 allows remote attackers to store uploaded files to any filesystem location when non-default configuration options UPLOAD_DIR and UPLOAD_KEEP_FILENAME=True are enabled. An attacker can exploit this path traversal vulnerability by crafting malicious filenames in multipart uploads, potentially overwriting critical system or application files. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 24 hours: Identify all systems using Python-Multipart with UPLOAD_DIR and UPLOAD_KEEP_FILENAME=True configurations. Within 7 days: Apply vendor patch to upgrade Python-Multipart to version 0.0.22 or later across all affected systems. …
Sign in for detailed remediation steps.
Priority Score
Vendor Status
Share
External POC / Exploit Code
Leaving vuln.today