peter bassill · operator
$ cve CVE-2026-24486 JSON

CVE-2026-24486 EXPLOIT

8.6
HIGH · CVSS 3.1 · EPSS 2.2% (pctl 82)

Patch early

A public exploit exists.

Description

Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename. Users should upgrade to version 0.0.22 to receive a patch or, as a workaround, avoid using `UPLOAD_KEEP_FILENAME=True` in project configurations.

Scoring

CVSS8.6 (HIGH, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
EPSS2.24% — more likely to be exploited than 82% of all CVEs
WeaknessCWE-22
On CISA KEVno
Public exploityes
Published2026-01-27
Last modified2026-08-07

Affected (1)

VendorProduct
fastapiexpertpython-multipart

Public exploits

SourceTitleDate
exploit-dbPython-Multipart 0.0.22 - Path Traversal2026-04-30

References

→ the Explorer  ·  watch your stack  ·  NVD