CVE-2026-24486: 
Python vulnerability analysis and mitigation

CVE-2026-24486 is a Path Traversal (arbitrary file write) vulnerability in the Python-Multipart library, a streaming multipart parser for Python. It affects all versions prior to 0.0.22 and was disclosed on January 25, 2026, with the GitHub Security Advisory (GHSA-wp53-j4wj-2cfg) published the same day and the NVD entry following on January 27, 2026. The vulnerability only manifests under a specific non-default configuration and carries a CVSS v3.1 base score of 8.6 (High) (Github Advisory, GitHub Security Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). When UPLOAD_DIR is set and UPLOAD_KEEP_FILENAME=True, the library constructs the upload file path using os.path.join(file_dir, fname). Python's os.path.join() discards all preceding path components when a subsequent argument begins with /, meaning a crafted filename like /etc/malicious causes the file to be written to /etc/malicious rather than the intended upload directory. Exploitation additionally requires the uploaded file to exceed MAX_MEMORY_FILE_SIZE, which triggers a flush to disk. The fix (commit 9433f4b) applies os.path.basename() to the filename before constructing the path, stripping any directory components (GitHub Security Advisory, Patch Commit).

Successful exploitation allows an unauthenticated remote attacker to write files to arbitrary locations on the server filesystem, limited only by the permissions of the process running the Python application. This could lead to remote code execution if files are written to executable or configuration directories (e.g., overwriting cron jobs, SSH authorized keys, or web server scripts), modification or overwriting of critical system or application files, and deployment of malware or web shells. The confidentiality impact is rated Low (incidental file read may be possible), integrity impact is High, and availability impact is Low (Github Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit code and no evidence of active in-the-wild exploitation (Github Advisory). The EPSS score is approximately 1.021% (78th percentile), indicating a moderate relative probability of exploitation within 30 days (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The vulnerability requires a specific non-default configuration to be exploitable, which limits the attack surface.

1. Reconnaissance: Identify web applications using python-multipart versions prior to 0.0.22 with UPLOAD_DIR set and UPLOAD_KEEP_FILENAME=True in their configuration. This can be done by reviewing application source code, dependency manifests (requirements.txt, pyproject.toml), or by probing file upload endpoints.
2. Craft malicious multipart request: Construct a multipart/form-data HTTP POST request targeting the application's file upload endpoint. Set the filename field in the Content-Disposition header to an absolute path such as /etc/cron.d/backdoor or /var/www/html/shell.py.
3. Ensure file size exceeds threshold: Include sufficient file content to exceed the application's MAX_MEMORY_FILE_SIZE setting, which triggers the library to flush the upload to disk rather than keeping it in memory — this is required for the path traversal to take effect.
4. Achieve arbitrary file write: The library calls os.path.join(upload_dir, "/etc/cron.d/backdoor"), which resolves to /etc/cron.d/backdoor, writing the attacker-controlled content to that path.
5. Achieve objective: Depending on the written file location and content, the attacker may achieve remote code execution (e.g., via a cron job or web shell), persistence, or data manipulation (GitHub Security Advisory, Patch Commit).

• Network: Multipart file upload HTTP POST requests where the Content-Disposition filename parameter contains an absolute path (e.g., starts with /) or path traversal sequences (e.g., ../).
• File System: Unexpected files appearing outside the configured UPLOAD_DIR, particularly in sensitive directories such as /etc/, /var/www/, /tmp/, or user home directories; new or modified cron jobs, SSH authorized_keys files, or web-accessible scripts.
• Logs: Web server or application access logs showing large multipart POST requests (exceeding MAX_MEMORY_FILE_SIZE) with filenames containing / or .. in the Content-Disposition header; file system audit logs (e.g., auditd) recording file creation events in unexpected directories by the web application process.
• Process: Unexpected processes spawned by the web application user account (e.g., reverse shells, cron-triggered commands) following suspicious upload activity.

Upgrade python-multipart to version 0.0.22 or later, which resolves the issue by applying os.path.basename() to uploaded filenames before constructing the file path (GitHub Release, Patch Commit). As an immediate workaround if patching is not possible, disable UPLOAD_KEEP_FILENAME=True in application configuration — the default configuration is not vulnerable (Github Advisory). Additionally, implement strict server-side filename validation to reject filenames containing /, \, or .., restrict file upload endpoints to authenticated users where feasible, and apply least-privilege filesystem permissions to the application process. IBM has issued advisories for affected products including Cloud Pak for Integration, IBM Engineering AI Hub, IBM Security QRadar EDR, and IBM watsonx Orchestrate (IBM Advisory).

The vulnerability was reported by three independent researchers (mwlik, imenyoo2, davidsilveiro) and promptly patched by the maintainer on the same day as disclosure (GitHub Security Advisory). The Hacker Wire covered the vulnerability shortly after disclosure, and it was noted on Mastodon and Bluesky by security community accounts (The Hacker Wire). Red Hat, Ubuntu, Fedora, SUSE, and Debian all issued advisories or package updates, reflecting broad downstream impact across Linux distributions. IBM issued multiple security bulletins for affected enterprise products including watsonx Orchestrate, Cloud Pak for Integration, and QRadar EDR (IBM Advisory).