Python-Multipart has Arbitrary File Write via Non-Default Configuration
Summary
A Path Traversal vulnerability exists when using non-default configuration options UPLOAD_DIR and UPLOAD_KEEP_FILENAME=True. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename.
Details
When UPLOAD_DIR is set and UPLOAD_KEEP_FILENAME is True, the library constructs the file path using os.path.join(file_dir, fname). Due to the behavior of os.path.join(), if the filename begins with a /, all preceding path components are discarded:
os.path.join("/upload/dir", "/etc/malicious") == "/etc/malicious"This allows an attacker to bypass the intended upload directory and write files to arbitrary paths.
Affected Configuration
Projects are only affected if all of the following are true:
UPLOAD_DIRis setUPLOAD_KEEP_FILENAMEis set to True- The uploaded file exceeds
MAX_MEMORY_FILE_SIZE(triggering a flush to disk)
The default configuration is not vulnerable.
Impact
Arbitrary file write to attacker-controlled paths on the filesystem.
Mitigation
Upgrade to version 0.0.22, or avoid using UPLOAD_KEEP_FILENAME=True in project configurations.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | python-multipart | < 0.0.22 | 0.0.22 |
References
- https://github.com/Kludex/python-multipart/security/advisories/GHSA-wp53-j4wj-2cfg
- https://nvd.nist.gov/vuln/detail/CVE-2026-24486
- https://github.com/Kludex/python-multipart/commit/9433f4bbc9652bdde82bbe380984e32f8cfc89c4
- https://github.com/Kludex/python-multipart
- https://github.com/Kludex/python-multipart/releases/tag/0.0.22
- https://pypi.org/project/python-multipart
- https://github.com/advisories/GHSA-wp53-j4wj-2cfg
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L- Weakness (CWE)
CWE-22- Platform
- Python (PyPI)
- Package
python-multipart- Disclosed
- 26.01.2026
- Updated
- 11.10.2026 15:17
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-1852 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-wp53-j4wj-2cfg - CC BY 4.0
Vulnerability history: python-multipart
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 9
- First → latest
- 02.2024 06.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 5
- Medium 1
- Low 3
Disclosures per year
- 2024: 2
- 2025: 0
- 2026: 7
-
Python-Multipart has Arbitrary File Write via Non-Default Configuration this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.