Python Multipart
Monthly
Arbitrary file write in Python-Multipart versions before 0.0.22 allows remote attackers to store uploaded files to any filesystem location when non-default configuration options UPLOAD_DIR and UPLOAD_KEEP_FILENAME=True are enabled. An attacker can exploit this path traversal vulnerability by crafting malicious filenames in multipart uploads, potentially overwriting critical system or application files. Public exploit code exists for this vulnerability; affected users should upgrade to version 0.0.22 or disable UPLOAD_KEEP_FILENAME=True as an interim mitigation.
Arbitrary file write in Python-Multipart versions before 0.0.22 allows remote attackers to store uploaded files to any filesystem location when non-default configuration options UPLOAD_DIR and UPLOAD_KEEP_FILENAME=True are enabled. An attacker can exploit this path traversal vulnerability by crafting malicious filenames in multipart uploads, potentially overwriting critical system or application files. Public exploit code exists for this vulnerability; affected users should upgrade to version 0.0.22 or disable UPLOAD_KEEP_FILENAME=True as an interim mitigation.