Description
Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename. Users should upgrade to version 0.0.22 to receive a patch or, as a workaround, avoid using `UPLOAD_KEEP_FILENAME=True` in project configurations.
Metrics
CVSS 3.1 7.5/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Kludex | python-multipart | < 0.0.22 |
| Red Hat | Red Hat AI Inference Server 3.2 | — |
| Red Hat | Red Hat AI Inference Server 3.2 | — |
| Red Hat | Red Hat Ansible Automation Platform 2.6 | — |
| Red Hat | Red Hat Ansible Automation Platform 2.6 | — |
| Red Hat | Red Hat OpenShift AI 2.25 | — |
| Red Hat | Red Hat OpenShift AI 2.25 | — |
| Red Hat | Red Hat OpenShift AI 2.25 | — |
| Red Hat | Red Hat OpenShift AI 2.25 | — |
| Red Hat | Red Hat OpenShift AI 2.25 | — |
| Red Hat | Red Hat OpenShift AI 3.3 | — |
| Red Hat | Red Hat OpenShift AI 3.3 | — |
| Red Hat | Red Hat Satellite 6.17 | — |
| Red Hat | Red Hat Satellite 6.18 | — |
| Red Hat | Red Hat Satellite 6.18 | — |
| Red Hat | Lightspeed Core | — |
| Red Hat | OpenShift Lightspeed | — |
| Red Hat | OpenShift Lightspeed | — |
| Red Hat | Red Hat AI Inference Server | — |
| Red Hat | Red Hat AI Inference Server | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | — |
References
- https://github.com/Kludex/python-multipart/commit/9433f4bbc9652bdde82bbe380984e32f8cfc89c4Patch
- https://github.com/Kludex/python-multipart/releases/tag/0.0.22Product, Release Notes
- https://github.com/Kludex/python-multipart/security/advisories/GHSA-wp53-j4wj-2cfgExploit, Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:10184
- https://access.redhat.com/errata/RHSA-2026:1504
- https://access.redhat.com/errata/RHSA-2026:19712
- https://access.redhat.com/errata/RHSA-2026:3461
- https://access.redhat.com/errata/RHSA-2026:3462
- https://access.redhat.com/errata/RHSA-2026:3713
- https://access.redhat.com/errata/RHSA-2026:3782
- https://access.redhat.com/errata/RHSA-2026:3960
- https://access.redhat.com/errata/RHSA-2026:42644
- https://access.redhat.com/errata/RHSA-2026:44696
- https://access.redhat.com/errata/RHSA-2026:51357
- https://access.redhat.com/security/cve/CVE-2026-24486
- https://bugzilla.redhat.com/show_bug.cgi?id=2433132
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24486.json
Timeline
- Published
- Jan 27, 2026
- Last modified
- Aug 7, 2026
- NVD status
- Modified