Skip to main content
HIGH

CVE-2026-24486

CVSS v3

8.6

HIGH

EPSS Score

2.2 %

exploit probability, as of 2026-09-25

CISA KEV

No

known exploited

Exploitation

—

SSVC status

Description

Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename. Users should upgrade to version 0.0.22 to receive a patch or, as a workaround, avoid using `UPLOAD_KEEP_FILENAME=True` in project configurations.

Technical details

Published
2026-01-27
Last Modified
2026-02-17
Exploit-DB
EDB-52543

Frequently asked questions

What is CVE-2026-24486?

Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename. Users should upgrade to version 0.0.22 to receive a patch or, as a workaround, avoid using `UPLOAD_KEEP_FILENAME=True` in project configurations.

Is CVE-2026-24486 actively exploited?

Active exploitation of CVE-2026-24486 has not been confirmed. Its EPSS score was 2.2% on 2026-09-25, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2026-24486?

CVE-2026-24486 has a CVSS v3 base score of 8.6 (HIGH severity).

Is CVE-2026-24486 affecting your environment?

Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.

Check an IPSearch CVEsSIEM & TIP integrations

No credit card required · 500 free checks/month · Free API key

Other 2026 vulnerabilities worth triaging

Ranked by exploit probability (EPSS).

Back to CVE Database