{"id":"CVE-2026-24486","aliases":["GHSA-wp53-j4wj-2cfg","PYSEC-2026-1852"],"url":"https://o3.security/vulnerability/CVE-2026-24486","summary":"Python-Multipart has Arbitrary File Write via Non-Default Configuration","details":"### Summary\n\nA Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename.\n\n### Details\n\nWhen `UPLOAD_DIR` is set and `UPLOAD_KEEP_FILENAME` is `True`, the library constructs the file path using `os.path.join(file_dir, fname)`. Due to the behavior of `os.path.join()`, if the filename begins with a `/`, all preceding path components are discarded:\n\n```py\nos.path.join(\"/upload/dir\", \"/etc/malicious\") == \"/etc/malicious\"\n```\n                        \nThis allows an attacker to bypass the intended upload directory and write files to arbitrary paths.                                         \n                                                                                                                                              \n#### Affected Configuration                                                                                                                      \n                                                                                                                                              \nProjects are only affected if all of the following are true:                                                                                     \n- `UPLOAD_DIR` is set\n- `UPLOAD_KEEP_FILENAME` is set to True\n- The uploaded file exceeds `MAX_MEMORY_FILE_SIZE` (triggering a flush to disk)\n\nThe default configuration is not vulnerable.                                                                                                \n                                                                                                                                              \n#### Impact                                                                                                                                   \n                                                                                                                                              \nArbitrary file write to attacker-controlled paths on the filesystem.                                                                        \n                                                                                                                                              \n#### Mitigation                                                                                                                                  \n                                                                                                                                              \nUpgrade to version 0.0.22, or avoid using `UPLOAD_KEEP_FILENAME=True` in project configurations.","published":"2026-01-27T00:34:06.229Z","modified":"2026-09-17T03:45:47.578676063Z","cvss":{"score":8.6,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L"},"epss":{"score":0.02208,"percentile":0.81735,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"PyPI","name":"python-multipart","fixedVersion":"0.0.22"}],"fix":{"url":"https://github.com/Kludex/python-multipart/commit/9433f4bbc9652bdde82bbe380984e32f8cfc89c4","label":"Kludex/python-multipart@9433f4b"},"references":[{"type":"WEB","url":"https://github.com/Kludex/python-multipart/releases/tag/0.0.22"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24486.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10184"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:1504"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19712"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:3461"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:3462"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:3713"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:3782"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:3960"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:42644"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:44696"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:51357"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-24486"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24486.json"},{"type":"ADVISORY","url":"https://github.com/Kludex/python-multipart/security/advisories/GHSA-wp53-j4wj-2cfg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24486"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2433132"},{"type":"FIX","url":"https://github.com/Kludex/python-multipart/commit/9433f4bbc9652bdde82bbe380984e32f8cfc89c4"},{"type":"PACKAGE","url":"https://github.com/Kludex/python-multipart"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-17T03:45:47.578676063Z"}}