Python-Multipart has Arbitrary File Write via Non-Default Configuration
Summary
A Path Traversal vulnerability exists when using non-default configuration options UPLOAD_DIR and UPLOAD_KEEP_FILENAME=True. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename.
Details
When UPLOAD_DIR is set and UPLOAD_KEEP_FILENAME is True, the library constructs the file path using os.path.join(file_dir, fname). Due to the behavior of os.path.join(), if the filename begins with a /, all preceding path components are discarded:
os.path.join("/upload/dir", "/etc/malicious") == "/etc/malicious"This allows an attacker to bypass the intended upload directory and write files to arbitrary paths.
Affected Configuration
Projects are only affected if all of the following are true:
UPLOAD_DIRis setUPLOAD_KEEP_FILENAMEis set to True- The uploaded file exceeds
MAX_MEMORY_FILE_SIZE(triggering a flush to disk)
The default configuration is not vulnerable.
Impact
Arbitrary file write to attacker-controlled paths on the filesystem.
Mitigation
Upgrade to version 0.0.22, or avoid using UPLOAD_KEEP_FILENAME=True in project configurations.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | python-multipart | < 0.0.22 | 0.0.22 |
Referencias
- https://github.com/Kludex/python-multipart/security/advisories/GHSA-wp53-j4wj-2cfg
- https://nvd.nist.gov/vuln/detail/CVE-2026-24486
- https://github.com/Kludex/python-multipart/commit/9433f4bbc9652bdde82bbe380984e32f8cfc89c4
- https://github.com/Kludex/python-multipart
- https://github.com/Kludex/python-multipart/releases/tag/0.0.22
- https://pypi.org/project/python-multipart
- https://github.com/advisories/GHSA-wp53-j4wj-2cfg
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L- Debilidad (CWE)
CWE-22- Plataforma
- Python (PyPI)
- Paquete
python-multipart- Publicada
- 26.01.2026
- Actualizado
- 11.10.2026 15:17
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2026-1852 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-wp53-j4wj-2cfg - CC BY 4.0
Historial de vulnerabilidades: python-multipart
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 9
- Primera → última
- 02.2024 06.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Alta 5
- Media 1
- Baja 3
Divulgaciones por año
- 2024: 2
- 2025: 0
- 2026: 7
-
Python-Multipart has Arbitrary File Write via Non-Default Configuration esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.