8.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-24486

CVE-2026-24486: Python-Multipart has Arbitrary File Write via Non-Default Configuration

Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options UPLOAD_DIR and UPLOAD_KEEP_FILENAME=True. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename. Users should upgrade to version 0.0.22 to receive a patch or, as a workaround, avoid using UPLOAD_KEEP_FILENAME=True in project configurations.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-24486

CVE-2026-24486:

8.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
python-multipart	pip	< 0.0.22	0.0.22

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a path traversal in the python-multipart library, identified as GHSA-wp53-j4wj-2cfg. The root cause is the improper handling of filenames in the File class constructor (__init__). When a file is uploaded with a specially crafted filename (e.g., /etc/passwd) and specific non-default settings are enabled (UPLOAD_DIR and UPLOAD_KEEP_FILENAME=True), the library fails to sanitize the filename. The File.__init__ method directly processes the filename without removing directory traversal characters. The patch 9433f4bbc9652bdde82bbe380984e32f8cfc89c4 introduces a call to os.path.basename() within File.__init__ to strip any directory information from the filename, thus mitigating the vulnerability. Therefore, File.__init__ is the vulnerable function where the malicious input is processed and made ready for exploitation, which is then triggered by the write method.

Vulnerable functions

File.__init__

python_multipart/multipart.py

The `__init__` method of the `File` class processes the user-provided filename. Before the patch, it used `os.path.splitext` directly on the filename, which could contain path traversal characters like `../` or start with `/`. This allowed an attacker to craft a filename that, when later joined with the upload directory, would result in a path outside the intended directory. The `write` method would then write the file to this malicious path.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.