CVE-2026-24486: Python multipart Python-Multipart Has Arbitrary File Write Vulnerability
HIGHCVE-2026-24486 is a HIGH (CVSS 8.6) python-multipart has arbitrary file write vulnerability (CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')) affecting Python multipart libraries in the PyPI ecosystem. The issue involves python-multipart has arbitrary file write via non-default configuration. Remediation is available by upgrading affected packages to version 0.0.22.
CVE-2026-24486 at a Glance
Security Impact
CVSS: 8.6
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L).
How to Fix CVE-2026-24486
To remediate this vulnerability, upgrade all affected Python multipart dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
pip install python-multipart>=0.0.22Run the following command in your project directory to verify that all resolved dependencies use the patched release:
pip show python-multipartHow to Check if You Are Affected
To determine whether your Python environment is affected by CVE-2026-24486, inspect your installed packages using pip:
pip show python-multipartAnalyze the terminal output to locate any version of Python multipart in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.0.22), your application is affected.
Note: The pip show python-multipart command checks currently installed packages in your active Python environment.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), where the product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. In Python multipart, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-24486 Affected Python multipart Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
python-multipart
|
PyPI |
< 0.0.22
|
0.0.22
|
References
Frequently Asked Questions
What is CVE-2026-24486?
Which Python multipart versions are affected?
What version fixes CVE-2026-24486?
Is python-multipart affected?
What is the CVSS score of CVE-2026-24486?
What CWE is associated with CVE-2026-24486?
How can I check PyPI dependencies for CVE-2026-24486?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-wp53-j4wj-2cfg",
"modified" : "2026-01-29T03:24:52Z",
"published" : "2026-01-26T23:28:05Z",
"aliases" : [ "CVE-2026-24486" ],
"summary" : "Python-Multipart has Arbitrary File Write via Non-Default Configuration",
"details" : "### Summary\n\nA Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename.\n\n### Details\n\nWhen `UPLOAD_DIR` is set and `UPLOAD_KEEP_FILENAME` is `True`, the library constructs the file path using `os.path.join(file_dir, fname)`. Due to the behavior of `os.path.join()`, if the filename begins with a `/`, all preceding path components are discarded:\n\n```py\nos.path.join(\"/upload/dir\", \"/etc/malicious\") == \"/etc/malicious\"\n```\n \nThis allows an attacker to bypass the intended upload directory and write files to arbitrary paths. \n \n#### Affected Configuration \n \nProjects are only affected if all of the following are true: \n- `UPLOAD_DIR` is set\n- `UPLOAD_KEEP_FILENAME` is set to True\n- The uploaded file exceeds `MAX_MEMORY_FILE_SIZE` (triggering a flush to disk)\n\nThe default configuration is not vulnerable. \n \n#### Impact \n \nArbitrary file write to attacker-controlled paths on the filesystem. \n \n#### Mitigation \n \nUpgrade to version 0.0.22, or avoid using `UPLOAD_KEEP_FILENAME=True` in project configurations.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "PyPI",
"name" : "python-multipart"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "0.0.22"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/Kludex/python-multipart/security/advisories/GHSA-wp53-j4wj-2cfg"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-24486"
}, {
"type" : "WEB",
"url" : "https://github.com/Kludex/python-multipart/commit/9433f4bbc9652bdde82bbe380984e32f8cfc89c4"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/Kludex/python-multipart"
}, {
"type" : "WEB",
"url" : "https://github.com/Kludex/python-multipart/releases/tag/0.0.22"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-22" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2026-01-26T23:28:05Z",
"nvd_published_at" : "2026-01-27T01:16:02Z"
}
}