CVE-2026-24486
📋 TL;DR
Python-Multipart versions before 0.0.22 contain a path traversal vulnerability when configured with UPLOAD_DIR and UPLOAD_KEEP_FILENAME=True. Attackers can write uploaded files to arbitrary filesystem locations by crafting malicious filenames. This affects any Python application using python-multipart with those specific configuration options enabled.
💻 Affected Systems
- python-multipart
📦 What is this software?
Python Multipart by Fastapiexpert
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via arbitrary file write leading to remote code execution, data destruction, or privilege escalation.
Likely Case
Unauthorized file writes to sensitive directories, potentially overwriting configuration files or deploying malicious scripts.
If Mitigated
Limited impact if proper file permissions restrict write access to non-critical directories.
🎯 Exploit Status
Exploitation requires file upload functionality with vulnerable configuration. No authentication needed if upload endpoint is exposed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.0.22
Vendor Advisory: https://github.com/Kludex/python-multipart/security/advisories/GHSA-wp53-j4wj-2cfg
Restart Required: Yes
Instructions:
1. Update python-multipart: pip install python-multipart==0.0.22
2. Restart your Python application
3. Verify the version: pip show python-multipart
🔧 Temporary Workarounds
Disable UPLOAD_KEEP_FILENAME
allSet UPLOAD_KEEP_FILENAME=False in your configuration to prevent filename-based path traversal.
🧯 If You Can't Patch
- Implement strict filename validation and sanitization before file writes
- Configure file system permissions to restrict write access to specific directories only
🔍 How to Verify
Check if Vulnerable:
Check if python-multipart version <0.0.22 AND configuration has UPLOAD_DIR set AND UPLOAD_KEEP_FILENAME=TrueCheck Version:
pip show python-multipart | grep VersionVerify Fix Applied:
Confirm python-multipart version is 0.0.22 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual file write patterns outside expected upload directories
- Filenames containing path traversal sequences (../)
Network Indicators:
- HTTP requests with filenames containing path traversal sequences in multipart uploads
SIEM Query:
source="web_logs" AND (filename="*../*" OR filename="*..\\*") AND method="POST" AND uri="*/upload*"