CVE-2026-24486
HighCVSS 8.6Exploitation Probability (EPSS)
High risk81th percentile - higher than 81% of all known CVEs
Summary
Python-Multipart versions prior to 0.0.22 have a Path Traversal vulnerability when using non-default configuration options UPLOAD_DIR and UPLOAD_KEEP_FILENAME=True. An attacker can write uploaded files to arbitrary filesystem locations via a crafted filename.
Risk Assessment
The organization is at risk of malicious file writes to sensitive locations, potentially leading to code execution, privilege escalation, or system damage.
Recommendation
Upgrade Python-Multipart to version 0.0.22 or later. As a workaround, avoid using UPLOAD_KEEP_FILENAME=True in project configurations.
Other vulnerabilities in Python-Multipart
See all- CVE-2026-42561High
Python-Multipart before version 0.0.27 did not limit the number or size of multipart/form-data part headers. An attacker can send a request with many repeated headers or a single very large header, causing excessive CPU load and denial of service.
- CVE-2026-40347Medium
Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted multipart/form-data requests with large preamble or epilogue sections. Upgrade to version 0.0.26 or later.
Original NVD description (English source)
Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename. Users should upgrade to version 0.0.22 to receive a patch or, as a workaround, avoid using `UPLOAD_KEEP_FILENAME=True` in project configurations.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS