3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-53537

CVE-2026-53537: python-multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters

Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, parse_options_header parsed Content-Disposition (and Content-Type) headers with email.message.Message, which transparently applies RFC 2231/5987 decoding. The extended parameter syntax (filename*=charset'lang'value, name*=..., and the filename0/filename1 continuation form) is decoded and surfaced under the bare filename/name key, and overrides the plain parameter when both are present. RFC 7578 §4.2 explicitly forbids the filename* form in multipart/form-data. Components that follow RFC 7578, or that do not implement RFC 2231/5987 decoding for multipart/form-data (WAFs, proxies, gateways), may interpret such a header differently. An attacker can exploit that difference to smuggle a different field name or filename past an upstream inspector to the backend. This vulnerability is fixed in 0.0.30.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-53537

CVE-2026-53537:

3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
python-multipart	pip	< 0.0.30	0.0.30

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic case of interpretation conflict (CWE-436) in how multipart/form-data headers are parsed. The python-multipart library's parse_options_header function previously used Python's email.message.Message class, which follows RFC 2231/5987 and gives precedence to extended parameters like filename*= over plain filename=. However, RFC 7578, the standard for multipart/form-data, explicitly forbids the filename* form. This discrepancy allows an attacker to craft a request that is interpreted differently by an intermediate proxy/WAF and the backend application. For example, a header like Content-Disposition: form-data; name="upload"; filename="safe.txt"; filename*=utf-8''evil.php would appear as a safe file upload to a compliant WAF, but python-multipart would pass evil.php to the application. The vulnerability was fixed by removing the dependency on email.message.Message for parsing and implementing a custom parser that ignores any parameters containing an asterisk (*), thus making the plain parameter authoritative. The security advisory notes that the high-level APIs FormParser, create_form_parser, and parse_form are all affected because they internally use the vulnerable parse_options_header function. Therefore, these functions are the likely entry points for an exploit and would appear in a runtime profile when the vulnerability is triggered.

Vulnerable functions

python_multipart.multipart.parse_options_header

python_multipart/multipart.py

The function was vulnerable to HTTP parameter smuggling. It incorrectly parsed `Content-Disposition` headers by prioritizing RFC 2231/5987 extended parameters (e.g., `filename*`) over standard parameters (e.g., `filename`). An attacker could provide a benign filename in the standard parameter to bypass upstream security checks (like a WAF) and a malicious filename in the extended parameter, which would be processed by the application. This could lead to bypassing file upload restrictions.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.