Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2026-24486
Kludex python-multipart — Python-Multipart has Arbitrary File Write via Non-Default Configuration
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L N N U N H N 7.5 .0224 82.2 —
AFFECTED
Product Versions Fixed
python-multipart < 0.0.22 – —
TIMELINE
Jan 23 Reserved by GitHub_M
Jan 27 Published (CNA: GitHub_M)
Aug 7 EXPLOIT PUBLISHED — CVE-2026-24486 (Kludex python-multipart). Public exploit reference added.
Aug 7 RESCORED — CVE-2026-24486 (Kludex python-multipart). CVSS 8.6 → 7.5 (NVD).
Description
Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename. Users should upgrade to version 0.0.22 to receive a patch or, as a workaround, avoid using `UPLOAD_KEEP_FILENAME=True` in project configurations.
Lifecycle
Complete event history — 4 events, chronological
| Date | Event | Detail |
|---|
| January 23, 2026 | Reserved | Reserved by GitHub_M |
| January 27, 2026 | Published | Published (CNA: GitHub_M) |
| August 7, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-24486 (Kludex python-multipart). Public exploit reference added. |
| August 7, 2026 | RESCORED | RESCORED — CVE-2026-24486 (Kludex python-multipart). CVSS 8.6 → 7.5 (NVD). |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| Kludex | python-multipart | — | < 0.0.22 | — |
References (17)
- https://access.redhat.com/errata/RHSA-2026:10184 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:1504 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:19712 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:3461 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:3462 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:3713 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:3782 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:3960 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:42644 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:44696 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/errata/RHSA-2026:51357 [vendor-advisory, x_refsource_REDHAT]
- https://access.redhat.com/security/cve/CVE-2026-24486 [vdb-entry, x_refsource_REDHAT]
- https://bugzilla.redhat.com/show_bug.cgi?id=2433132 [issue-tracking, x_refsource_REDHAT]
- https://github.com/Kludex/python-multipart/commit/9433f4bbc9652bdde82bbe380984e32f8cfc89c4 [x_refsource_MISC]
- https://github.com/Kludex/python-multipart/releases/tag/0.0.22 [x_refsource_MISC]
- https://github.com/Kludex/python-multipart/security/advisories/GHSA-wp53-j4wj-2cfg [x_refsource_CONFIRM]
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24486.json [x_sadp-csaf-vex]
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-24486 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
