Python-Multipart has Arbitrary File Write via Non-Default Configuration

SummaryA Path Traversal vulnerability exists when using non-default configuration options UPLOADDIR and UPLOADKEEPFILENAME=True. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename. DetailsWhen UPLOADDIR is set and UPLOADKEEPFILENAME is...

PYSEC-2026-1852 Python-Multipart has Arbitrary File Write via Non-Default Configuration

Summary A Path Traversal vulnerability exists when using non-default configuration options UPLOADDIR and UPLOADKEEPFILENAME=True. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename. Details When UPLOADDIR is set and UPLOADKEEPFILENAME is...

The vulnerability of the UPLOAD_DIR configuration and the UPLOAD_KEEP_FILENAME=True setting in the python-multipart streaming multi-component parser allows a attacker to write arbitrary files.

The vulnerability of the UPLOADDIR configuration and the UPLOADKEEPFILENAME=True setting in the Python-multipart streaming parser is related to an incorrect restriction on the path to the restricted directory. Exploiting this vulnerability could allow a remote attacker to write arbitrary files...