CVE-2026-24486
highpriority · track · 41EPSS 0.022 · 82 %ileexploit · PoCDEEURUUSEPSS · scored 2026-10-27
Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename. Users should upgrade to version 0.0.22 to receive a patch or, as a workaround, avoid using `UPLOAD_KEEP_FILENAME=True` in project configurations.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- Fixedpython311-python-multipart-0:0.0.9-150600.3.6.1.noarch as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedpython313-python-multipart-0:0.0.20-160000.3.1.noarch as component of SUSE Linux Enterprise Server 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedpython313-python-multipart-0:0.0.20-160000.3.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedpython313-python-multipart-0:0.0.20-160000.3.1.noarch as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (1)
Public proof-of-concept and weaponised exploit code.
- EDB-52543Python-Multipart 0.0.22 - Path TraversalPoC · exploit_db
affected products (6)
Products and version ranges known to be affected.
advisories (6)
Vendor and ecosystem advisories describing this.
- SUSE-SU-2026:0307-1Security update for python-python-multipart2026-01-27csaf · suse_csafDE
Security update for python-python-multipart
- SUSE-SU-2026:20188-1Security update for python-python-multipart2026-01-28csaf · suse_csafDE
Security update for python-python-multipart
- WID-SEC-W-2026-3046IBM Concert: Mehrere SchwachstellenDeutsch2026-08-26csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in IBM Concert ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um einen SQL-Injection Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.
- openSUSE-SU-2026:20125-1Security update for python-python-multipart2026-01-28csaf · suse_csafDE
Security update for python-python-multipart
- GHSA-wp53-j4wj-2cfgPython-Multipart has Arbitrary File Write via Non-Default Configuration2026-01-26ghsa · osvUS
### Summary A Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename. ### Details When `UPLOAD_DIR` is set and `UPLOAD_KEEP_FILENAME` is `True`, the library constructs the file path using `os.path.join(file_dir, fname)`. Due to the behavior of `os.path.join()`, if the filename begins with a `/`, all preceding path components are discarded: ```py os.path.join("/upload/dir", "/etc/malicious") == "/etc/malicious" ``` This allows an attacker to bypass the intended upload directory and write files to arbitrary paths. #### Affected Configuration Projects are only affected if all of the following are true: - `UPLOAD_DIR` is set - `UPLOAD_KEEP_FILENAME` is set to True - The uploaded file exceeds `MAX_MEMORY_FILE_SIZE` (triggering a flush to disk) The default configuration is not vulnerable. #### Impact Arbitrary file write to attacker-controlled paths on the filesystem. #### Mitigation Upgrade to version 0.0.22, or avoid using `UPLOAD_KEEP_FILENAME=True` in project configurations.
- PYSEC-2026-1852Python-Multipart has Arbitrary File Write via Non-Default Configuration2026-07-07vendor · osvUS
### Summary A Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename. ### Details When `UPLOAD_DIR` is set and `UPLOAD_KEEP_FILENAME` is `True`, the library constructs the file path using `os.path.join(file_dir, fname)`. Due to the behavior of `os.path.join()`, if the filename begins with a `/`, all preceding path components are discarded: ```py os.path.join("/upload/dir", "/etc/malicious") == "/etc/malicious" ``` This allows an attacker to bypass the intended upload directory and write files to arbitrary paths. #### Affected Configuration Projects are only affected if all of the following are true: - `UPLOAD_DIR` is set - `UPLOAD_KEEP_FILENAME` is set to True - The uploaded file exceeds `MAX_MEMORY_FILE_SIZE` (triggering a flush to disk) The default configuration is not vulnerable. #### Impact Arbitrary file write to attacker-controlled paths on the filesystem. #### Mitigation Upgrade to version 0.0.22, or avoid using `UPLOAD_KEEP_FILENAME=True` in project configurations.
also known as (7)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (27)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2026-24486cnnvd
- https://cxsecurity.com/issue/WLB-2026030015cnnvd
- https://github.com/Kludex/python-multipart/commit/9433f4bbc9652bdde82bbe380984e32f8cfc89c4cnnvd
- https://github.com/Kludex/python-multipart/releasesPatchcnnvd
- https://github.com/Kludex/python-multipart/releases/tag/0.0.22cnnvd
- https://github.com/Kludex/python-multipart/security/advisories/GHSA-wp53-j4wj-2cfgcnnvd
- https://www.exploit-db.com/exploits/52543cnnvd
- https://github.com/Kludex/python-multipart/commit/9433f4bbc9652bdde82bbe380984e32f8cfc89c4enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan