CVE-2026-24486: Python-Multipart has Arbitrary File Write via Non-Default Configuration
(updated )
A Path Traversal vulnerability exists when using non-default configuration options UPLOAD_DIR and UPLOAD_KEEP_FILENAME=True. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename.
References
- github.com/Kludex/python-multipart
- github.com/Kludex/python-multipart/commit/9433f4bbc9652bdde82bbe380984e32f8cfc89c4
- github.com/Kludex/python-multipart/releases/tag/0.0.22
- github.com/Kludex/python-multipart/security/advisories/GHSA-wp53-j4wj-2cfg
- github.com/advisories/GHSA-wp53-j4wj-2cfg
- nvd.nist.gov/vuln/detail/CVE-2026-24486
Code Behaviors & Features
Detect and mitigate CVE-2026-24486 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →