A path traversal vulnerability in Fastapi's Python-Multipart library allows arbitrary file write when using non-default configuration options. Specifically, if UPLOAD_DIR is set and UPLOAD_KEEP_FILENAME is True, an attacker can craft filenames starting with '/' to write files outside the intended upload directory. This affects versions from 0.111.0 up to but not including 0.128.0_2. The vulnerability is fixed in version 0.128.0_2.