Executive brief
Python-Multipart is a software library used by web frameworks like FastAPI to process data uploaded through web forms. A security flaw allows attackers to hide or "smuggle" malicious filenames or form field names past security filters (like firewalls) by using specialized formatting that the library interprets differently than the filters. This could allow an attacker to bypass upload restrictions or, in some cases, perform unauthorized file operations on the server.
Technical details
An interpretation conflict (CWE-436) exists in Python-Multipart's parse_options_header function. Prior to version 0.0.30, the parser used email.message.Message to decode Content-Disposition headers, which incorrectly applied RFC 2231/5987 decoding to multipart/form-data—a practice explicitly forbidden by RFC 7578. This allows extended parameters (like filename*) to override plain parameters (like filename). Because many WAFs and proxies follow RFC 7578 and ignore the extended form, an attacker can craft a header where the security proxy sees a "safe" filename while the Python backend processes a "malicious" one. This can lead to path traversal via decoded sequences like '..%2F' or bypasses of filename-based access controls. The issue is fixed in version 0.0.30 by ignoring extended parameters.
Affected products
- Kludex python-multipart < 0.0.30
Timeline
- 2026-06-04: advisory: GitHub Security Advisory published by Kludex
- 2026-06-22: disclosed: CVE-2026-53537 published to NVD
- 2026-06-22: patched: Vulnerability fixed in version 0.0.30