Path traversal in python-multipart - CVE-2026-24486

Vulnerability identifier: #VU122010

CSH Severity: High

CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-24486

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when using non-default configuration options "UPLOAD_DIR" and "UPLOAD_KEEP_FILENAME=True". A remote attacker can send a specially crafted HTTP request and write arbitrary files on the system.

python-multipart
watsonx Code Assistant On Prem
Maximo Application Suite - Visual Inspection Component
Platform Navigator in IBM Cloud Pak for Integration (CP4I)
Fusion Content-Aware Storage
Fedora
openSUSE Leap
Ubuntu
openEuler
python-multipart (Ubuntu package)
python311-python-multipart
python-python-multipart
python3-python-multipart
IBM Fusion HCI

Install updates from vendor's website.

python-multipart - update to 0.0.22
watsonx Code Assistant On Prem - update to 5.3.1
Maximo Application Suite - Visual Inspection Component - update to 9.1.10
Platform Navigator in IBM Cloud Pak for Integration (CP4I) - update to 16.1.3.4
python-multipart (Ubuntu package) - addressed in versions 0.0.5-2ubuntu0.1~esm1, 0.0.9-1ubuntu0.1~esm1
python311-python-multipart - update to 0.0.9-150600.3.6.1
python-python-multipart - addressed in versions 0.0.20-2.el9, 0.0.22-1.el10_1, 0.0.22-1.el10_2, 0.0.22-1.fc42, 0.0.22-1.fc43
python-python-multipart - update to 0.0.22-1
python3-python-multipart - update to 0.0.22-1
Fusion Content-Aware Storage - update to 1.1.3
IBM Fusion HCI - update to 2.12.2

• https://github.com/Kludex/python-multipart/security/advisories/GHSA-wp53-j4wj-2cfg

• Path traversal in python-multipart
• Ubuntu update for python-multipart
• Fedora 43 update for python-python-multipart
• Fedora 42 update for python-python-multipart
• Fedora EPEL 10.1 update for python-python-multipart
• Fedora EPEL 10.2 update for python-python-multipart
• Fedora EPEL 9 update for python-python-multipart
• SUSE update for python-python-multipart
• Multiple vulnerabilities in IBM watsonx Code Assistant On Prem
• IBM Maximo Application Suite - Visual Inspection Component update for Python-Multipart
• Platform Navigator in IBM Cloud Pak for Integration (CP4I) update for Python-Multipart
• openEuler 24.03 LTS SP3 update for python-python-multipart
• IBM Fusion, IBM Fusion HCI and IBM Fusion Content-Aware Storage update for Python-Multipart