CVE-2026-24486 Details
Description
Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename. Users should upgrade to version 0.0.22 to receive a patch or, as a workaround, avoid using `UPLOAD_KEEP_FILENAME=True` in project configurations.
A path traversal vulnerability allowing arbitrary file writes has been identified in Python-Multipart versions prior to 0.0.22. This issue arises when the `UPLOAD_DIR` option is set and `UPLOAD_KEEP_FILENAME` is enabled. Under these conditions, an attacker can craft a filename that exploits the way file paths are constructed, bypassing the intended upload directory and writing files to arbitrary locations on the filesystem. The vulnerability is triggered when the uploaded file exceeds the `MAX_MEMORY_FILE_SIZE` limit, causing it to be flushed to disk.
Users should upgrade to Python-Multipart version 0.0.22 or later. If an upgrade is not possible, avoid using `UPLOAD_KEEP_FILENAME=True` in project configurations.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | redhat-SADP |
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| fastapiexpert python-multipart | < 0.0.22 |
CPE
Remediation
| |
Change History
9 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 7, 2026 | CVE Modified | redhat-SADP |
| Jul 24, 2026 | CVE Modified | redhat-SADP |
| Jul 21, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Feb 17, 2026 | Initial Analysis | [email protected] |
| Jan 27, 2026 | New CVE Received | [email protected] |