https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 22:53:37 +0000 https://vulnerability.circl.lu/vuln/cve-2026-24486 <p><strong>Affected:</strong> Kludex python-multipart, Red Hat AI Inference Server 3.2, Red Hat Ansible Automation Platform 2.6, Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 3.3, Red Hat Satellite 6.17, Red Hat Satellite 6.18, Red Hat Lightspeed Core, Red Hat OpenShift Lightspeed, Red Hat AI Inference Server and 4 more</p> <p>Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename. Users should upgrade to version 0.0.22 to receive a patch or, as a workaround, avoid using `UPLOAD_KEEP_FILENAME=True` in project configurations.</p> <p><strong>Affected:</strong> Kludex python-multipart, Red Hat AI Inference Server 3.2, Red Hat Ansible Automation Platform 2.6, Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 3.3, Red Hat Satellite 6.17, Red Hat Satellite 6.18, Red Hat Lightspeed Core, Red Hat OpenShift Lightspeed, Red Hat AI Inference Server and 4 more</p> <p>Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename. Users should upgrade to version 0.0.22 to receive a patch or, as a workaround, avoid using `UPLOAD_KEEP_FILENAME=True` in project configurations.</p> https://vulnerability.circl.lu/vuln/cve-2026-24486