PT-2026-4841 · Pypi+2 · Python-Multipart+2

Imenyoo2 + 1 · Published 2026-01-25 · Updated 2026-05-09 · CVE-2026-24486

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:N/C:P/I:C/A:P

Name of the Vulnerable Software and Affected Versions Python-Multipart versions prior to 0.0.22

Description Python-Multipart is a streaming multipart parser for Python. A Path Traversal issue exists when using non-default configuration options UPLOAD DIR and UPLOAD KEEP FILENAME=True. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename. The issue occurs because the library constructs the file path using os.path.join(), and if the filename begins with a '/', all preceding path components are discarded. This allows bypassing the intended upload directory and writing files to arbitrary paths. The vulnerability is only present if UPLOAD DIR is set, UPLOAD KEEP FILENAME is set to True, and the uploaded file exceeds MAX MEMORY FILE SIZE.

Recommendations Upgrade to version 0.0.22. Alternatively, avoid using UPLOAD KEEP FILENAME=True in project configurations.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2026-01058

CVE-2026-24486

GHSA-WP53-J4WJ-2CFG

OESA-2026-2276

OPENSUSE-SU-2026:20125-1

SUSE-SU-2026:0307-1

SUSE-SU-2026:20188-1

USN-8027-1

Affected Products

Linuxmint

Python-Multipart

Ubuntu

References · 35

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24486.json · Exploit
• 🔥 https://exploit-db.com/exploits/52543 · Exploit
• https://github.com/Kludex/python-multipart/security/advisories/GHSA-wp53-j4wj-2cfg · Vendor Advisory
• https://github.com/Kludex/python-multipart/commit/9433f4bbc9652bdde82bbe380984e32f8cfc89c4 · Patch
• https://ubuntu.com/security/CVE-2024-53981 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20125-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8027-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2276 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24486 · Security Note
• https://osv.dev/vulnerability/GHSA-wp53-j4wj-2cfg · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-24486 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-24486 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-24486 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-01058 · Security Note
• https://ubuntu.com/security/CVE-2024-24762 · Vendor Advisory