openEuler-SA-2026-2276

Synopsis:

python-python-multipart security updateSummary:

An update for python-python-multipart is now available for openEuler-24.03-LTS-SP3Description:

A streaming multipart parser for Python

Security Fix(es):

Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options UPLOAD_DIR and UPLOAD_KEEP_FILENAME=True. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename. Users should upgrade to version 0.0.22 to receive a patch or, as a workaround, avoid using UPLOAD_KEEP_FILENAME=True in project configurations.(CVE-2026-24486)Topic:

An update for python-python-multipart is now available for openEuler-24.03-LTS-Next/openEuler-24.03-LTS-SP2/openEuler-24.03-LTS-SP3/openEuler-24.03-LTS-SP4/openEuler-25.03/openEuler-25.09.

openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.Severity:

HighAffected Component:

python-python-multipart