Skip to content
fr Sign in
8.6 High

CVE-2026-24486 Python-Multipart is a streaming multipart parser for Python

Description

Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename. Users should upgrade to version 0.0.22 to receive a patch or, as a workaround, avoid using `UPLOAD_KEEP_FILENAME=True` in project configurations.

Affected products and versions

Product Affected versions Fixed in
python-multipart 0.0 earliest → < 0.0.22 0.0.22
Red Hat AI Inference Server 3.2 1772160625 earliest → < 1772160625 1772160625
Red Hat Ansible Automation Platform 2.6 1772429277 earliest → < 1772429277 1772429277
Red Hat OpenShift AI 2.25 1783998857 earliest → < 1783998857 1783998857
Red Hat OpenShift AI 3.3 1770956034 earliest → < 1770956034 1770956034
Red Hat Satellite 6.18 1784554123 earliest → < 1784554123 1784554123
Lightspeed Core Versions not published
OpenShift Lightspeed Versions not published
Red Hat AI Inference Server Versions not published
Show the 5 other branches
Product Affected versions Fixed in
Red Hat Ansible Automation Platform 2 Versions not published
Red Hat Enterprise Linux AI (RHEL AI) 3 Versions not published
Red Hat OpenShift AI (RHOAI) Versions not published
Red Hat Satellite 6 Versions not published
Red Hat Satellite 6.17 1784834402 earliest → < 1784834402 1784834402

References

Timeline

  1. Published
  2. Last modified

Other CVEs of python-multipart

The 9 CVEs of python-multipart →
CVE-2026-53540 Python-Multipart is a streaming multipart parser for Python 3.7 Low CVE-2026-53537 Python-Multipart is a streaming multipart parser for Python 3.7 Low CVE-2026-53538 Python-Multipart is a streaming multipart parser for Python 3.7 Low CVE-2026-53539 Python-Multipart is a streaming multipart parser for Python 7.5 High
Track this CVE