CVE-2026-24486: Python-Multipart has Arbitrary File Write via Non-Default Configuration
Summary
A Path Traversal vulnerability exists when using non-default configuration options UPLOADDIR and UPLOADKEEPFILENAME=True. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename.
Details
When UPLOADDIR is set and UPLOADKEEPFILENAME is True, the library constructs the file path using os.path.join(filedir, fname). Due to the behavior of os.path.join(), if the filename begins with a /, all preceding path components are discarded:
py os.path.join("/upload/dir", "/etc/malicious") == "/etc/malicious" This allows an attacker to bypass the intended upload directory and write files to arbitrary paths. Affected Configuration Projects are only affected if all of the following are true: - UPLOADDIR is set - UPLOADKEEPFILENAME is set to True - The uploaded file exceeds MAXMEMORYFILESIZE (triggering a flush to disk)
The default configuration is not vulnerable. Impact Arbitrary file write to attacker-controlled paths on the filesystem. Mitigation Upgrade to version 0.0.22, or avoid using UPLOADKEEPFILENAME=True in project configurations.
Other sources
Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options UPLOADDIR and UPLOADKEEPFILENAME=True. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename. Users should upgrade to version 0.0.22 to receive a patch or, as a workaround, avoid using UPLOADKEEPFILENAME=True in project configurations.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24486?
CVE-2026-24486 is considered a high severity vulnerability due to its potential for arbitrary file write capabilities.
How do I fix CVE-2026-24486?
To fix CVE-2026-24486, ensure that you are using the default configuration for the `UPLOAD_DIR` and set `UPLOAD_KEEP_FILENAME=False`.
Which versions of python-multipart are affected by CVE-2026-24486?
Versions of python-multipart prior to 0.0.22 are affected by CVE-2026-24486.
What types of attacks can exploit CVE-2026-24486?
CVE-2026-24486 can be exploited by attackers to write malicious files to arbitrary locations on the filesystem.
Is there a workaround for CVE-2026-24486 if I cannot upgrade?
If upgrading is not possible, a temporary workaround is to disable non-default configuration options related to file uploads.