Python-Multipart versions before 0.0.22 contain a CWE-22 path traversal vulnerability triggered when the configuration options UPLOAD_DIR and UPLOAD_KEEP_FILENAME=True are enabled. This flaw allows remote attackers to write files to arbitrary locations on the server by submitting specially crafted filenames during file uploads. The vulnerability impacts confidentiality, integrity, and availability by enabling unauthorized file creation or modification, which could lead to system compromise. The vulnerability is confirmed and documented by Red Hat advisories, which recommend upgrading to version 0.0.22 or disabling the UPLOAD_KEEP_FILENAME=True option to mitigate the risk.

An attacker can write files to arbitrary locations on the server filesystem, potentially overwriting or creating critical files used for code execution or security mechanisms. This can lead to unauthorized code execution, bypass of security controls, exposure of sensitive data, and denial of service by corrupting essential files. The vulnerability affects confidentiality, integrity, and availability of the affected system.

A fix is available in python-multipart version 0.0.22. Users should upgrade to this version to fully remediate the vulnerability. As a workaround, avoid enabling the UPLOAD_KEEP_FILENAME=True configuration option when using UPLOAD_DIR, since disabling this option prevents the path traversal vulnerability. Follow vendor advisories for updates and patches.