CVE-2026-53537 Details
Description
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, parse_options_header parsed Content-Disposition (and Content-Type) headers with email.message.Message, which transparently applies RFC 2231/5987 decoding. The extended parameter syntax (filename*=charset'lang'value, name*=..., and the filename*0/filename*1 continuation form) is decoded and surfaced under the bare filename/name key, and overrides the plain parameter when both are present. RFC 7578 §4.2 explicitly forbids the filename* form in multipart/form-data. Components that follow RFC 7578, or that do not implement RFC 2231/5987 decoding for multipart/form-data (WAFs, proxies, gateways), may interpret such a header differently. An attacker can exploit that difference to smuggle a different field name or filename past an upstream inspector to the backend. This vulnerability is fixed in 0.0.30.
A vulnerability exists in Python-Multipart versions prior to 0.0.30, allowing for content smuggling through the 'Content-Disposition' and 'Content-Type' headers. The issue arises because the 'parse_options_header' function decodes extended parameter syntaxes using RFC 2231 and RFC 5987, potentially leading to the manipulation of field names or filenames. This vulnerability is particularly concerning for components that adhere to RFC 7578 or do not properly handle these RFCs in 'multipart/form-data' contexts, as it could allow an attacker to bypass upstream inspections and alter how data is processed by the backend.
Users are advised to upgrade to Python-Multipart version 0.0.30 or later, which addresses this vulnerability by disregarding extended parameters in 'Content-Disposition' and 'Content-Type' headers, ensuring that only the plain parameters are considered authoritative.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Kludex/python-multipart/security/advisories/GHSA-vffw-93wf-4j4q | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
| CWE-436 | Interpretation Conflict | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| fastapiexpert python-multipart | < 0.0.30 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 22, 2026 | New CVE Received | [email protected] |