Is CVE-2026-24486 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-24486 being exploited in the wild.

How severe is CVE-2026-24486?

High severity, with a CVSS score of 8.6, published 27 January 2026.

Which products and versions are affected?

python-multipart (PyPI) ECOSYSTEM:introduced=0,fixed=0.0.22.

Is there a fix for CVE-2026-24486?

Yes. python-multipart (PyPI): upgrade to 0.0.22 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-24486 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-24486?

Check whether you run python-multipart (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-24486: Kludex python-multipart path traversal in file upload handler

CVE-2026-24486 · Severity: high · CVSS 8.6 · Published 2026-01-27

Python-Multipart, a library used by web applications to handle file uploads, contains a security flaw that allows attackers to write files to unauthorized locations on a server. By providing a specially crafted filename during an upload, an attacker could potentially overwrite sensitive system files or plant malicious scripts. This risk is present when the library is configured to save files using their original names in a specific directory.

Technologies: python-multipart (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-24486 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-24486 being exploited in the wild.
How severe is CVE-2026-24486?: High severity, with a CVSS score of 8.6, published 27 January 2026.
Which products and versions are affected?: python-multipart (PyPI) ECOSYSTEM:introduced=0,fixed=0.0.22.
Is there a fix for CVE-2026-24486?: Yes. python-multipart (PyPI): upgrade to 0.0.22 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-24486 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-24486?: Check whether you run python-multipart (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

python-multipart (PyPI): upgrade to 0.0.22 or later
```
pip install "python-multipart>=0.0.22"
```

Technical details

A path traversal vulnerability exists in python-multipart prior to version 0.0.22. When the library is configured with 'UPLOAD_DIR' and 'UPLOAD_KEEP_FILENAME=True', it uses 'os.path.join()' to construct the final storage path. Because 'os.path.join()' discards previous path components if a subsequent component (the attacker-controlled filename) begins with a forward slash, an attacker can specify an absolute path to write files anywhere the application has permissions. This requires the uploaded file to exceed 'MAX_MEMORY_FILE_SIZE' to trigger a disk write. The issue is resolved in version 0.0.22 by ensuring only the basename of the provided filename is used.

Affected products

Kludex python-multipart < 0.0.22
Red Hat Red Hat OpenShift AI 2.25, 3.3
Red Hat Red Hat Ansible Automation Platform 2, 2.6
Red Hat Red Hat Satellite 6, 6.18
Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3

Identifiers

CVE-2026-24486
GHSA-wp53-j4wj-2cfg
PYSEC-2026-1852

Timeline

2026-01-25: patched: Version 0.0.22 released
2026-01-25: advisory: GitHub Security Advisory GHSA-wp53-j4wj-2cfg published
2026-01-27: disclosed: CVE-2026-24486 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.