CVE-2026-24486High· 8.6▾ MidnightPoC availablePython-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 47.3 · likelihood 0.4 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Jul 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
2.2%
Exploit-DB (last check)
Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options UPLOAD_DIR and UPLOAD_KEEP_FILENAME=True. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename. Users should upgrade to version 0.0.22 to receive a patch or, as a workaround, avoid using UPLOAD_KEEP_FILENAME=True in project configurations.
python-multipart < 0.0.22Upgrade past the affected range:
python-multipart 0.0.22Affected packages:
python-multipart < 0.0.22Patched in:
python-multipart 0.0.22Source: https://osv.dev/vulnerability/GHSA-wp53-j4wj-2cfg
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-42561High· 7.5python-multipart has Denial of Service via unbounded multipart part headers
CVE-2026-40347Medium· 5.3python-multipart affected by Denial of Service via large multipart preamble or epilogue data
CVE-2024-53981High· 7.5Denial of service (DoS) via deformation `multipart/form-data` boundary
CVE-2024-24762High· 7.5python-multipart vulnerable to Content-Type Header ReDoS
CVE-2026-53537Low· 3.7python-multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters
CVE-2026-53538Low· 3.7python-multipart: Semicolon treated as querystring field separator enables parameter smuggling