ExploitPublished
Python-Multipart 0.0.22 - Path Traversal
Source Exploit-DB RSS Feed
0
Mentioned vulnerabilities
Severity
MediumRated by Threat Radar
Data as of 6 May 2026, 02:38 UTC
What to do
AI-suggested
A fix is available by upgrading python-multipart to version 0.0.22 or later. Additionally, avoid enabling UPLOAD_KEEP_FILENAME=True and ensure filenames are sanitized by using only the basename (e.g., filename = os.path.basename(file.filename)) before saving uploaded files. These steps prevent directory traversal in filenames and mitigate the vulnerability.
Description
Python-Multipart 0.0.22 - Path Traversal
Indicators of compromise
Exploit source code
# Exploit Title: Python-Multipart 0.0.22 - Path Traversal
# Date: 2026-02-23
# Exploit Author: cardosource
# Vendor Homepage: https://github.com/Kludex/python-multipart
# Software Link: https://pypi.org/project/python-multipart/
# Version: < 0.0.22 (REQUIRED)
# Tested on: Ubuntu / Python 3.13.5 / Docker (as root for demo)
# CVE : CVE-2026-24486
"""
PoC for CVE-2026-24486: Path Traversal in python-multipart when UPLOAD_KEEP_FILENAME=True + UPLOAD_DIR is configured.
Allows arbitrary file write v…References
Community reviews
Loading reviews…