CVE-2026-24486 Python-Multipart has Arbitrary File Write via Non-Default Configuration
Attackers can write files to arbitrary filesystem locations via crafted filenames when specific non-default upload options are enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-24486?
CVE-2026-24486 is a high-severity path traversal vulnerability in Kludex python-multipart, published on 27 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename. Users should upgrade to version 0.0.22 to receive a patch or, as a workaround, avoid using `UPLOAD_KEEP_FILENAME=True` in project configurations.
Weakness: CWE-22
Which versions are affected by CVE-2026-24486?
3 open source packages ship an affected version, including python-multipart. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
python-multipart PyPI | All versions | 0.0.22 |
python-multipart PyPI | All versions | 0.0.22 |
python-multipart PyPI | All versions | 0.0.22 |
Linux distribution packages (4)
python-python-multipart SUSE:Linux Enterprise Server 16.0 | All versions | 0.0.20-160000.3.1 |
python-python-multipart SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 0.0.20-160000.3.1 |
python-python-multipart openSUSE:Leap 15.6 | All versions | 0.0.9-150600.3.6.1 |
python-python-multipart openSUSE:Leap 16.0 | All versions | 0.0.20-160000.3.1 |
Products include Fastapiexpert Python-Multipart.
How do I fix CVE-2026-24486?
Upgrade python-multipart to 0.0.22 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-24486 being exploited?
There is no known exploitation of CVE-2026-24486 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Kludex python-multipart
- CVE-2026-53539 Python-Multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service
- CVE-2024-24762 python-multipart vulnerable to content-type header Regular expression Denial of Service
- CVE-2026-40347 Python-Multipart affected by Denial of Service via large multipart preamble or epilogue data
- CVE-2026-53537 Python-Multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters
- CVE-2026-53538 Python-Multipart: Semicolon treated as querystring field separator enables parameter smuggling
Sources
Also known as CLSA-2026-1786503821, DEBIAN-CVE-2026-24486, GHSA-wp53-j4wj-2cfg, MINI-22c2-9f9f-8w32, MINI-4v6r-gr5c-j43v, MINI-5fm2-57p5-xhq9 and 9 more.