Junglewise Threat Intelligence

CVE-2026-24486: Kludex python-multipart path traversal in file upload handler

CVE-2026-24486 · Severity: high · CVSS 8.6 · Published 2026-01-27

Technologies: python-multipart (PyPI), Red Hat Enterprise Linux AI (RHEL AI). Vendors: PyPI, Red Hat, Kludex.

Executive brief

Python-Multipart, a library used by web applications to handle file uploads, contains a security flaw that allows attackers to write files to unauthorized locations on a server. By providing a specially crafted filename during an upload, an attacker could potentially overwrite sensitive system files or plant malicious scripts. This risk is present when the library is configured to save files using their original names in a specific directory.

Technical details

A path traversal vulnerability exists in python-multipart prior to version 0.0.22. When the library is configured with 'UPLOAD_DIR' and 'UPLOAD_KEEP_FILENAME=True', it uses 'os.path.join()' to construct the final storage path. Because 'os.path.join()' discards previous path components if a subsequent component (the attacker-controlled filename) begins with a forward slash, an attacker can specify an absolute path to write files anywhere the application has permissions. This requires the uploaded file to exceed 'MAX_MEMORY_FILE_SIZE' to trigger a disk write. The issue is resolved in version 0.0.22 by ensuring only the basename of the provided filename is used.

Affected products

  • Kludex python-multipart < 0.0.22
  • Red Hat Red Hat OpenShift AI 2.25, 3.3
  • Red Hat Red Hat Ansible Automation Platform 2, 2.6
  • Red Hat Red Hat Satellite 6, 6.18
  • Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3

Timeline

  • 2026-01-25: patched: Version 0.0.22 released
  • 2026-01-25: advisory: GitHub Security Advisory GHSA-wp53-j4wj-2cfg published
  • 2026-01-27: disclosed: CVE-2026-24486 published to NVD

References

Related threats