---
id: CVE-2026-53537
aliases:
  - GHSA-vffw-93wf-4j4q
  - PYSEC-2026-3041
title: >-
  python-multipart: Content-Disposition parameter smuggling via RFC 2231/5987
  extended parameters
summary: >-
  python-multipart: Content-Disposition parameter smuggling via RFC 2231/5987
  extended parameters
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'
vendor: python-multipart
product: python-multipart
ecosystem: pip
affected:
  - python-multipart < 0.0.30
patched:
  - python-multipart 0.0.30
published: '2026-06-15'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:50.585695996Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-vffw-93wf-4j4q'
references:
  - url: >-
      https://github.com/Kludex/python-multipart/security/advisories/GHSA-vffw-93wf-4j4q
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53537'
  - url: 'https://github.com/Kludex/python-multipart'
  - url: 'https://github.com/advisories/GHSA-vffw-93wf-4j4q'
  - url: >-
      https://github.com/pypa/advisory-database/blob/main/vulns/python-multipart/PYSEC-2026-3041.yaml
  - url: 'https://pypi.org/project/python-multipart'
tags:
  - osv
  - pip
  - ghsa
epss: 0.00291
epssPercentile: 0.21983
cwe:
  - CWE-20
  - CWE-436
ingestedAt: '2026-07-07T15:41:58.650Z'
---

## Overview

### Summary

`parse_options_header` parsed `Content-Disposition` (and `Content-Type`) headers with [`email.message.Message`](https://docs.python.org/3/library/email.compat32-message.html#email.message.Message), which transparently applies [RFC 2231](https://datatracker.ietf.org/doc/html/rfc2231)/[5987](https://datatracker.ietf.org/doc/html/rfc5987) decoding. The extended parameter syntax (`filename*=charset'lang'value`, `name*=...`, and the `filename*0`/`filename*1` continuation form) is decoded and surfaced under the bare `filename`/`name` key, and overrides the plain parameter when both are present. [RFC 7578 §4.2](https://datatracker.ietf.org/doc/html/rfc7578#section-4.2) explicitly forbids the `filename*` form in `multipart/form-data`.

Components that follow RFC 7578, or that do not implement RFC 2231/5987 decoding for `multipart/form-data` (WAFs, proxies, gateways), may interpret such a header differently. An attacker can exploit that difference to smuggle a different field name or filename past an upstream inspector to the backend.

### Details

Given both a plain and an extended parameter, the extended value won. For example:

```
Content-Disposition: form-data; name="comment"; name*=utf-8''role
```

An inspector following RFC 7578 sees the field `comment`, while the returned value was `name=role`. The same applies to filenames:

```
Content-Disposition: form-data; name="upload"; filename="safe.txt"; filename*=utf-8''evil.php
```

The inspector sees `safe.txt`, while the returned value was `filename=evil.php`. Continuation parameters (`filename*0`, `filename*1`, and so on) were likewise reassembled into a `filename` invisible to a plain `filename=` match, and percent encoded sequences in the extended value were decoded (so `..%2F`, `%00`, and similar appeared in the returned filename).

This affects the high level `parse_options_header`, `FormParser`, `create_form_parser`, and `parse_form` APIs, and reaches Starlette/FastAPI through `request.form()`, where the smuggled value is exposed as the form field name or [`UploadFile.filename`](https://www.starlette.io/requests/#request-files).

### Impact

This is an interpretation conflict ([CWE-436](https://cwe.mitre.org/data/definitions/436.html)) with other `multipart/form-data` parsers. An attacker able to submit `multipart/form-data` can present a different field name or filename to an upstream body inspecting component than the one delivered to the application. Concrete consequences depend on how the application uses these values, and may include bypassing a field name or filename based access/upload control, or, for an application that builds filesystem paths from the parsed filename without sanitization, path traversal via decoded `..%2F` sequences. Decoded control bytes such as `%00` can likewise cause confusion between an upstream validator and the backend. The `File` class applies `os.path.basename`, so file writing through it is not directly affected.

### Mitigation

Upgrade to `python-multipart` `0.0.30` or later, which ignores RFC 2231/5987 extended parameters (`name*`, `filename*`, and their continuations) so the plain `name`/`filename` parameter remains authoritative. RFC 7578 §4.2 forbids `filename*` for `multipart/form-data`; `name*` and the continuation forms are dropped for the same reason, since they are not valid `multipart/form-data` parameters either.

## Affected packages

- `python-multipart < 0.0.30`

## Remediation

Upgrade to a patched release:

- `python-multipart 0.0.30`