---
id: CVE-2024-22049
title: >-
  httparty before 0.21.0 is vulnerable to an assumed-immutable web parameter
  vulnerability
summary: >-
  httparty before 0.21.0 is vulnerable to an assumed-immutable web parameter
  vulnerability. A remote and unauthenticated attacker can provide a crafted
  filename parameter during multipart/form-data uploads which could result in
  attacker co…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-472
vendor: jnunemaker
product: httparty
affected:
  - debian_linux = 10.0
  - debian_linux = 11.0
  - fedora = 38
  - fedora = 39
  - httparty < 0.21.0
patched:
  - httparty 0.21.0
published: '2024-01-04'
updated: '2026-07-14'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-22049'
references:
  - url: 'https://github.com/advisories/GHSA-5pq7-52mg-hr42'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/jnunemaker/httparty/blob/4416141d37fd71bdba4f37589ec265f55aa446ce/lib/httparty/request/body.rb#L43
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/jnunemaker/httparty/commit/cdb45a678c43e44570b4e73f84b1abeb5ec22b8e
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/jnunemaker/httparty/security/advisories/GHSA-5pq7-52mg-hr42
    label: disclosure@vulncheck.com
  - url: 'https://lists.debian.org/debian-lts-announce/2024/01/msg00011.html'
    label: disclosure@vulncheck.com
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4LDGAVPR4KB72V4GGQCWODEAI72QZI3V/
    label: disclosure@vulncheck.com
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IOWECZPJY6JZIA5FSBJR77KCRDXWDZDA/
    label: disclosure@vulncheck.com
  - url: 'https://vulncheck.com/advisories/vc-advisory-GHSA-5pq7-52mg-hr42'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/advisories/GHSA-5pq7-52mg-hr42'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://github.com/jnunemaker/httparty/blob/4416141d37fd71bdba4f37589ec265f55aa446ce/lib/httparty/request/body.rb#L43
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://github.com/jnunemaker/httparty/commit/cdb45a678c43e44570b4e73f84b1abeb5ec22b8e
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://github.com/jnunemaker/httparty/security/advisories/GHSA-5pq7-52mg-hr42
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2024/01/msg00011.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2024/09/msg00043.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4LDGAVPR4KB72V4GGQCWODEAI72QZI3V/
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IOWECZPJY6JZIA5FSBJR77KCRDXWDZDA/
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://vulncheck.com/advisories/vc-advisory-GHSA-5pq7-52mg-hr42'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.0129
epssPercentile: 0.68949
ingestedAt: '2026-07-14T23:40:04.613Z'
---

## Overview

httparty before 0.21.0 is vulnerable to an assumed-immutable web parameter vulnerability. A remote and unauthenticated attacker can provide a crafted filename parameter during multipart/form-data uploads which could result in attacker controlled filenames being written.

## Affected

- `debian_linux = 10.0`
- `debian_linux = 11.0`
- `fedora = 38`
- `fedora = 39`
- `httparty < 0.21.0`

## Remediation

Upgrade past the affected range:

- `httparty 0.21.0`