The vulnerability of the UPLOAD_DIR configuration and the UPLOAD_KEEP_FILENAME=True setting in the python-multipart streaming multi-component parser allows a attacker to write arbitrary files.

🗓️ 30 Jan 2026 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec🔗 bdu.fstec.ru👁 17 Views

The UPLOAD_DIR and UPLOAD_KEEP_FILENAME=True settings in the python-multipart parser enable remote arbitrary file writes.

Reporter	Title	Published	Views	Family All 89
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which is vulnerable to multiple CVEs.	31 Mar 202613:54	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge	18 May 202607:00	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx.data integration has several vulnerabilities due to open source packages (CVE-2026-24486,CVE-2025-50537,CVE-2026-24688)	20 Mar 202616:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in python-multipart (CVE-2026-24486, CVE-2026-40347, CVE-2026-42561, CVE-2026-53540)	21 Sep 202607:07	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator in IBM Cloud Pak for Integration is vulnerable to vulnerability in python_multipart	10 Apr 202608:27	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Security QRadar EDR Software	2 Jun 202608:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses python_multipart-0.0.21-py3-none-any.whl which is vulnerable to CVE-2026-24486	6 Apr 202610:57	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Python-Multipart bundled with IBM Fusion, IBM Fusion HCI and IBM Fusion Content-Aware Storage	17 Jun 202612:16	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in python-multipart (CVE-2026-24486, CVE-2026-40347, CVE-2026-42561)	23 Sep 202609:50	–	ibm
attackerkb	CVE-2026-24486	27 Jan 202600:34	–	attackerkb

Source	Link
github	www.github.com/Kludex/python-multipart/commit/9433f4bbc9652bdde82bbe380984e32f8cfc89c4
github	www.github.com/Kludex/python-multipart/releases/tag/0.0.22
github	www.github.com/Kludex/python-multipart/security/advisories/GHSA-wp53-j4wj-2cfg
web	www.web.nvd.nist.gov/view/vuln/detail

18 Feb 2026 00:00Current

6.5Medium risk

Vulners AI Score6.5

CVSS 38.6

CVSS 29

EPSS0.02239

upload directory keep filename true python multipart streaming parser arbitrary file write path restriction