High · published January 27, 2026
⚡ Crafty filenames can spell disaster! Before version 0.0.22, Python-Multipart allows uploads to go rogue, letting attackers write files anywhere on your filesystem! 🔥 Think of it like a mischievous delivery driver who can drop packages not just at your door, but anywhere around your neighborhood, just by using the right address! An attacker could exploit this vulnerability to place malicious files in sensitive system locations, potentially leading to unauthorized access or data breaches. The consequences could be absolutely devastating for your application and your users if an attacker successfully navigates your filesystem!
Think of it like a mischievous delivery driver who can drop packages not just at your door, but anywhere around your neighborhood, just by using the right address! This Path Traversal vulnerability results from a lack of proper validation for uploaded filenames when the configuration options `UPLOAD_KEEP_FILENAME=True` and non-default `UPLOAD_DIR` are used. It allows crafted filenames to manipulate file storage locations on the server.
An attacker could exploit this vulnerability to place malicious files in sensitive system locations, potentially leading to unauthorized access or data breaches. The consequences could be absolutely devastating for your application and your users if an attacker successfully navigates your filesystem! Upgrade to version 0.0.22 to patch this vulnerability immediately! Alternatively, if an upgrade isn't feasible right now, consider disabling the `UPLOAD_KEEP_FILENAME=True` setting in your configurations to mitigate the risk. Stay vigilant! You've got this! With these steps, you'll be on your way to securing your application in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| fastapiexpert/python-multipart | < 0.0.22 | 0.0.22 |