CVE-2026-24486: Python-Multipart has Arbitrary File Write via Non-Default Configuration

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-01-27 · updated 2026-08-07
Weakness: CWE-22

Description

Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename. Users should upgrade to version 0.0.22 to receive a patch or, as a workaround, avoid using `UPLOAD_KEEP_FILENAME=True` in project configurations.

Affected products

Kludex python-multipart: before 0.0.22 — fixed in 0.0.22

How to fix

Upgrade to a fixed version: Kludex python-multipart 0.0.22. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-24486 or the next vulnerability affects your stack