CVE-2026-24486

HighCVSS 8.6

Published: 27/01/2026(UTC)Updated: 07/08/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.23%

81th percentile - higher than 81% of all known CVEs

Summary

Python-Multipart versions prior to 0.0.22 have a Path Traversal vulnerability when using non-default configuration options UPLOAD_DIR and UPLOAD_KEEP_FILENAME=True. An attacker can write uploaded files to arbitrary filesystem locations via a crafted filename.

Risk Assessment

The organization is at risk of malicious file writes to sensitive locations, potentially leading to code execution, privilege escalation, or system damage.

Recommendation

Upgrade Python-Multipart to version 0.0.22 or later. As a workaround, avoid using UPLOAD_KEEP_FILENAME=True in project configurations.

Other vulnerabilities in Python-Multipart

CVE-2026-42561High
Python-Multipart before version 0.0.27 did not limit the number or size of multipart/form-data part headers. An attacker can send a request with many repeated headers or a single very large header, causing excessive CPU load and denial of service.

Original NVD description (English source)

Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename. Users should upgrade to version 0.0.22 to receive a patch or, as a workaround, avoid using `UPLOAD_KEEP_FILENAME=True` in project configurations.