Arbitrary File Write Vulnerability in Python-Multipart Package
Summary
GHSA-wp53-j4wj-2cfg: Python-Multipart has Arbitrary File Write via Non-Default Configuration. Affects python-multipart versions < 0.0.22. Fixed in 0.0.22. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python-Multipart is a library used for handling multipart file uploads in Python applications. It simplifies the process of receiving files from users, allowing developers to easily manage file uploads in web applications. However, due to specific configuration settings, it is susceptible to a serious vulnerability that can lead to arbitrary file writes on the server's filesystem.
Vulnerability Detail
The vulnerability arises from a Path Traversal issue when the configuration options UPLOAD_DIR and UPLOAD_KEEP_FILENAME are set to specific values. If an attacker uploads a file with a crafted filename that begins with a '/', the library uses os.path.join() to construct the file path, leading to the potential for the file to be written to an arbitrary location on the filesystem. This can result in unauthorized access to sensitive files or system compromise, as attackers can manipulate the file paths to write files outside the intended upload directory.
How To Fix
Latest published version: 0.0.32 as of 23 Oct 2026
pip install --upgrade "python-multipart==0.0.32"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.0.22
This is the first release that contains the fix.
pip install --upgrade "python-multipart==0.0.22"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the configuration option UPLOAD_KEEP_FILENAME=True in your project settings. This will prevent the library from using the original filename provided by the user, thus mitigating the risk of the vulnerability. Instead, you can generate a unique filename for each upload, ensuring it does not contain any path traversal characters.
Conclusion
The Python-Multipart package has a critical vulnerability that allows arbitrary file writes due to improper handling of file paths under specific configurations. It is essential to upgrade to the latest version to mitigate this risk and ensure the security of your application.
See every vulnerability recorded for python-multipart →
FAQ
The CVSS score of this vulnerability is 8.6, indicating a high severity level.
Projects are affected if UPLOAD_DIR is set, UPLOAD_KEEP_FILENAME is True, and the uploaded file exceeds MAX_MEMORY_FILE_SIZE.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in your software, using just the Pipfile.lock.
If you cannot upgrade the package, ensure that you do not use UPLOAD_KEEP_FILENAME=True and consider implementing additional input validation to sanitize filenames.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-multipart.
