--- id: CVE-2026-24486 title: Python-Multipart is a streaming multipart parser for Python summary: >- Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write … severity: high cvss: 8.6 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L' cwe: - CWE-22 vendor: fastapiexpert product: python-multipart affected: - python-multipart < 0.0.22 patched: - python-multipart 0.0.22 published: '2026-01-27' updated: '2026-06-30' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-24486' references: - url: >- https://github.com/Kludex/python-multipart/commit/9433f4bbc9652bdde82bbe380984e32f8cfc89c4 label: security-advisories@github.com - url: 'https://github.com/Kludex/python-multipart/releases/tag/0.0.22' label: security-advisories@github.com - url: >- https://github.com/Kludex/python-multipart/security/advisories/GHSA-wp53-j4wj-2cfg label: security-advisories@github.com - url: 'https://access.redhat.com/errata/RHSA-2026:10184' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:1504' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:19712' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:3461' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:3462' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:3713' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:3782' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:3960' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/security/cve/CVE-2026-24486' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2433132' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24486.json label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-24486' - url: 'https://github.com/Kludex/python-multipart' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-24486' - url: 'https://access.redhat.com/errata/RHSA-2026:42644' - url: 'https://access.redhat.com/errata/RHSA-2026:44696' - url: 'https://access.redhat.com/errata/RHSA-2026:51357' tags: - nvd - exploit-available - osv - pip - cve.org - csaf - vex - red-hat epss: 0.02208 epssPercentile: 0.81835 exploitAvailable: true ingestedAt: '2026-06-30T17:40:12.462Z' exploits: exploitdb: true checkedAt: '2026-09-24T07:53:01.082Z' aliases: - GHSA-wp53-j4wj-2cfg - PYSEC-2026-1852 ecosystem: pip ssvc: exploitation: none automatable: 'no' technicalImpact: partial timestamp: '2026-01-27T20:50:56.753228Z' --- ## Overview Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename. Users should upgrade to version 0.0.22 to receive a patch or, as a workaround, avoid using `UPLOAD_KEEP_FILENAME=True` in project configurations. ## Affected - `python-multipart < 0.0.22` ## Remediation Upgrade past the affected range: - `python-multipart 0.0.22` ## Package advisory (CVE-2026-24486) Affected packages: - `python-multipart < 0.0.22` Patched in: - `python-multipart 0.0.22` Source: https://osv.dev/vulnerability/GHSA-wp53-j4wj-2cfg ## Vendor advisories - **RHSA-2026:3461** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-02-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:3461) - **RHSA-2026:3462** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-02-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:3462) - **RHSA-2026:3960** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-03-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:3960) - **RHSA-2026:10184** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-04-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:10184) - **RHSA-2026:42644** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-07-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:42644) - **RHSA-2026:3782** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-03-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:3782) - **RHSA-2026:19712** · Red Hat · fixed in: Red Hat OpenShift AI 3.3 · released 2026-05-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:19712) - **RHSA-2026:3713** · Red Hat · fixed in: Red Hat OpenShift AI 3.3 · released 2026-03-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:3713) - **RHSA-2026:44696** · Red Hat · fixed in: Red Hat Satellite 6.17 · released 2026-07-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:44696) - **RHSA-2026:1504** · Red Hat · fixed in: Red Hat Satellite 6.18 · released 2026-01-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:1504) - **RHSA-2026:51357** · Red Hat · fixed in: Red Hat Satellite 6.18 · released 2026-08-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:51357) - **Red Hat VEX** · Important · affected: Lightspeed Core, OpenShift Lightspeed, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), … · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Lightspeed Core, … · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24486.json)