Python-Multipart versions before 0.0.30 parse Content-Disposition and Content-Type headers using email.message.Message, which applies RFC 2231/5987 decoding. This decoding exposes extended parameter syntax (e.g., filename*=charset'lang'value) under the standard filename/name keys, overriding plain parameters. RFC 7578 §4.2 forbids the use of filename* in multipart/form-data, so components adhering to RFC 7578 or lacking RFC 2231/5987 decoding may interpret these headers differently. An attacker can exploit this inconsistency to smuggle different field names or filenames past upstream inspectors such as WAFs, proxies, or gateways, potentially bypassing security controls. The vulnerability is addressed by fixing the parsing behavior in python-multipart version 0.0.30.

This vulnerability allows an attacker to bypass upstream security inspection by exploiting differences in header parsing, potentially leading to the smuggling of altered field names or filenames to backend systems. The impact is limited to information integrity (low impact) without direct confidentiality or availability effects. There are no known exploits in the wild.

Upgrade python-multipart to version 0.0.30 or later, where this vulnerability is fixed. No other mitigation is indicated or required.