PT-2026-49569 · Starlette+2 · Starlette+2
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Python-Multipart versions prior to 0.0.30
Description
The
parse options header function parsed Content-Disposition and Content-Type headers using email.message.Message, which applies RFC 2231/5987 decoding. This allows extended parameter syntax, such as filename*, name*, and continuation forms (filename*0, filename*1), to override plain parameters when both are present. However, RFC 7578 §4.2 explicitly forbids the filename* form in multipart/form-data.This creates an interpretation conflict where upstream components (such as WAFs, proxies, or gateways) that follow RFC 7578 or do not implement RFC 2231/5987 decoding may interpret headers differently than the backend. An attacker can exploit this to smuggle a different field name or filename past an inspector. This affects the
parse options header, FormParser, create form parser, and parse form APIs, and impacts Starlette/FastAPI via request.form(), exposing smuggled values as form field names or UploadFile.filename.Potential consequences include bypassing access or upload controls based on field names or filenames, and path traversal if the application builds filesystem paths from the parsed filename without sanitization, as percent-encoded sequences like
..%2F are decoded.Recommendations
Update to version 0.0.30 or later.
Exploit
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Fastapi
Python-Multipart
Starlette