Threats tagged 'brew-fastmcp-cve-2026-24486'

Fastmcp's Python-Multipart library has a path traversal vulnerability (CVE-2026-24486) when using a non-default configuration with UPLOAD_DIR set and UPLOAD_KEEP_FILENAME=True. This allows an attacker to write files to arbitrary filesystem locations by crafting filenames starting with '/'. The vulnerability only triggers if the uploaded file exceeds MAX_MEMORY_FILE_SIZE, causing a flush to disk. The default configuration is not vulnerable. A fix is available in version 2.14.4_1.