CVE-2026-24486

Fixed in a distro release EPSS 2%CVSS 8.6

Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename. Users should upgrade to version 0.0.22 to receive a patch or, as a workaround, avoid using `UPLOAD_KEEP_FILENAME=True` in project configurations.

Published 2026-01-27 · CVE record · OSV

Products: Kludex python-multipart, Red Hat AI Inference Server 3.2, Red Hat Ansible Automation Platform 2.6, Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 3.3, Red Hat Satellite 6.17, Red Hat Satellite 6.18, Red Hat Lightspeed Core, Red Hat OpenShift Lightspeed, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Red Hat Satellite 6

Fixed upstream

Distro releases