What is the CVSS score of CVE-2026-24486?

CVE-2026-24486 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Python are affected by CVE-2026-24486?

python-multipart versions below 0.0.22 enable remote attackers to write files to unauthorized system directories in deployments using the UPLOAD_KEEP_FILENAME feature; publicly available exploit code…. A patch is available.

Is there a public PoC exploit available for CVE-2026-24486?

Yes, a public proof-of-concept exploit is available for CVE-2026-24486. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-24486?

24 hours: Inventory deployments using python-multipart ≤0.0.21; determine if UPLOAD_KEEP_FILENAME option is enabled. 7 days: Upgrade to python-multipart 0.0.22; test thoroughly in non-production environments. 30 days: Complete production deployment; validate that file upload functionality operates correctly; document version verification.

Python CVE-2026-24486

HIGH

Path Traversal (CWE-22)

2026-01-27 security-advisories@github.com

GHSA-wp53-j4wj-2cfg

Python Path Traversal Python Multipart

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

5.9 MEDIUM

Network-reachable and unauthenticated, but AC:H because exploitation depends on the non-default UPLOAD_KEEP_FILENAME=True configuration; impact is arbitrary file write so I:H, C:N/A:N.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Red Hat

8.6 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Jun 30, 2026 - 05:58 vuln.today

v5 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 05:56 vuln.today

v4 (cvss_changed)

Source Code Evidence Fetched

Jun 30, 2026 - 05:55 vuln.today

Analysis Updated

Jun 30, 2026 - 05:55 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 05:54 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 30, 2026 - 03:23 vuln.today

cvss_changed

CVSS changed

Jun 30, 2026 - 03:23 NVD

8.6 (HIGH) 7.5 (HIGH)

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 17, 2026 - 20:44 vuln.today

Public exploit code

Patch released

Feb 17, 2026 - 20:44 nvd

Patch available

CVE Published

Jan 27, 2026 - 01:16 nvd

HIGH 8.6

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

72 pypi packages depend on python-multipart (47 direct, 25 indirect)

Ecosystem-wide dependent count for version 0.0.22.

DescriptionNVD

Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options UPLOAD_DIR and UPLOAD_KEEP_FILENAME=True. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename. Users should upgrade to version 0.0.22 to receive a patch or, as a workaround, avoid using UPLOAD_KEEP_FILENAME=True in project configurations.

AnalysisAI

Arbitrary file write in python-multipart prior to 0.0.22 lets remote attackers place uploaded files outside the intended upload directory by supplying a filename that begins with an absolute path (e.g. '/etc/...'). The flaw only manifests in deployments that enable the non-default options UPLOAD_DIR plus UPLOAD_KEEP_FILENAME=True, where os.path.join silently discards the configured directory. Publicly available exploit code exists (Exploit-DB 52543, GHSA-wp53-j4wj-2cfg), though EPSS is very low (0.03%, 7th percentile) and it is not in CISA KEV.

More in Python

View all

CVE-2025-24016 CRITICAL Act Now POC

9.9 Feb 10

Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t

CVE-2025-27520 CRITICAL Act Now POC

9.8 Apr 04

BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser

CVE-2025-2945 CRITICAL Act Now POC

9.9 Apr 03

pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi

CVE-2013-5093 MEDIUM This Month POC

6.8 Sep 27

The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python

CVE-2025-32375 CRITICAL Act Now POC

9.8 Apr 09

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica

CVE-2014-0224 HIGH Act Now POC

7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph

CVE-2024-21644 HIGH Act Now POC

7.5 Jan 08

pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.

CVE-2026-33017 CRITICAL Act Now POC

9.3 Mar 17

Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301

CVE-2017-9462 HIGH Act Now POC

8.8 Jun 06

In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse

CVE-2026-49869 CRITICAL Act Now POC

10.0 Jun 26

Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to

CVE-2026-39987 CRITICAL Act Now POC

9.3 Apr 08

Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/

CVE-2024-21645 MEDIUM This Month POC

5.3 Jan 08

pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne

Same weakness CWE-22 – Path Traversal

View all

CVE-2019-3396 CRITICAL POC

9.8

CVE-2019-19781 CRITICAL POC

9.8

CVE-2020-5902 CRITICAL POC

9.8

CVE-2021-21972 CRITICAL POC

9.8

CVE-2021-40444 HIGH POC

8.8

CVE-2022-41352 CRITICAL POC

9.8

CVE-2021-27065 HIGH POC

7.8

CVE-2019-11510 CRITICAL POC

10.0

Same technique Path Traversal

View all

CVE-2019-19781 CRITICAL POC

9.8

CVE-2021-21972 CRITICAL POC

9.8

CVE-2021-40444 HIGH POC

8.8

CVE-2022-41352 CRITICAL POC

9.8

CVE-2021-27065 HIGH POC

7.8

CVE-2018-20250 HIGH POC

7.8

CVE-2022-37042 CRITICAL POC

9.8

CVE-2025-64446 CRITICAL POC

9.8

Vendor StatusVendor

SUSE

Severity: High

Product	Status
SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server for SAP applications 16.0	Fixed
openSUSE Leap 15.6	Fixed
openSUSE Leap 16.0	Fixed
SUSE Linux Enterprise Server 16.0	Affected
SUSE Linux Enterprise Server 16.0	Fixed

CVE-2026-24486 vulnerability details – vuln.today

Back

SUSE Linux Enterprise Server 16.1	Fixed
SUSE Linux Enterprise Server for SAP applications 16.0	Fixed
SUSE Linux Enterprise Server for SAP applications 16.1	Fixed
openSUSE Leap 15.6	Fixed

Python CVE-2026-24486

Severity by source

CVSS VectorNVD

Lifecycle Timeline

Blast Radius

DescriptionNVD

AnalysisAI

More in Python

Same weakness CWE-22 – Path Traversal

Same technique Path Traversal

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code