Lucene search
+L

CVE-2026-24486

🗓️ 27 Jan 2026 00:34:06Reported by GitHub_MType 
cve
 cve
🔗 web.nvd.nist.gov👁 119 Views🌐 WEB

CVE-2026-24486: Python-Multipart allows arbitrary file writes via non-default UPLOAD_DIR and UPLOAD_KEEP_FILENAME.

Related
Detection
Affected
Refs
Paths
ReporterTitlePublishedViews
Family
IBM Security Bulletins
Security Bulletin: Maximo AI Service uses multiple third party dependencies which is vulnerable to multiple CVEs.
31 Mar 202613:54
ibm
IBM Security Bulletins
Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge
18 May 202607:00
ibm
IBM Security Bulletins
Security Bulletin: IBM watsonx.data integration has several vulnerabilities due to open source packages (CVE-2026-24486,CVE-2025-50537,CVE-2026-24688)
20 Mar 202616:40
ibm
IBM Security Bulletins
Security Bulletin: Platform Navigator in IBM Cloud Pak for Integration is vulnerable to vulnerability in python_multipart
10 Apr 202608:27
ibm
IBM Security Bulletins
Security Bulletin: Multiple vulnerabilities in IBM Security QRadar EDR Software
2 Jun 202608:49
ibm
IBM Security Bulletins
Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses python_multipart-0.0.21-py3-none-any.whl which is vulnerable to CVE-2026-24486
6 Apr 202610:57
ibm
IBM Security Bulletins
Security Bulletin: Vulnerability in Python-Multipart bundled with IBM Fusion, IBM Fusion HCI and IBM Fusion Content-Aware Storage
17 Jun 202612:16
ibm
ATTACKERKB
CVE-2026-24486
27 Jan 202600:34
attackerkb
AlpineLinux
CVE-2026-24486
27 Jan 202600:34
alpinelinux
BDU FSTEC
The vulnerability of the UPLOAD_DIR configuration and the UPLOAD_KEEP_FILENAME=True setting in the python-multipart streaming multi-component parser allows a attacker to write arbitrary files.
30 Jan 202600:00
bdu_fstec
Rows per page
NVD
Vulners
Node
[
  {
    "vendor": "Kludex",
    "product": "python-multipart",
    "versions": [
      {
        "version": "< 0.0.22",
        "status": "affected"
      }
    ]
  }
]
ParameterPositionPathDescriptionCWE
filenamepath/uploadPath traversal in multipart file upload allows arbitrary file write via crafted filename.CWE-22

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

15 Jul 2026 02:18Current
6Medium risk
Vulners AI Score6
CVSS 3.17.5 - 8.6
EPSS0.02228
SSVC
119