CVE-2026-24486
Python-Multipart has Arbitrary File Write via Non-Default Configuration
HIGH 7.5EPSS 2.2%
Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename. Users should upgrade to version 0.0.22 to receive a patch or, as a workaround, avoid using `UPLOAD_KEEP_FILENAME=True` in project configurations.
- Affected
- Kludex · python-multipart
- CVSS v3.1 NVD
- 7.5 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS v3.1 CNA
- 8.6 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L - EPSS
- 2.24% chance of exploitation in the next 30 days, 83rd percentile
- Published
- 2026-01-27
- Updated
- 2026-09-16
ExploitDB entries (1)
Security advisories
- Kludex/python-multipart/security/advisories/GHSA-wp53-j4wj-2cfg
- advisories/GHSA-wp53-j4wj-2cfg
- Kludex/python-multipart/commit/9433f4bbc9652bdde82bbe380984e32f8cfc89c4