Threats tagged 'brew-mcp-proxy-cve-2026-53537'

The python-multipart library improperly handles RFC 2231/5987 extended parameters in Content-Disposition headers for multipart/form-data. This allows an attacker submitting multipart/form-data to smuggle different field names or filenames past upstream inspectors that do not decode these extended parameters, potentially bypassing access controls or causing path traversal if filenames are unsafely used. The issue is fixed in python-multipart version 0.12.0_2 by ignoring these extended parameters, aligning with RFC 7578 which forbids them in multipart/form-data.