Описание
Security update for python-python-multipart
This update for python-python-multipart fixes the following issues:
- CVE-2026-24486: Fixed non-default configuration options can lead to path traversal (bsc#1257301).
Список пакетов
openSUSE Leap 15.6
python311-python-multipart-0.0.9-150600.3.6.1
Ссылки
- Link for SUSE-SU-2026:0307-1
- E-Mail link for SUSE-SU-2026:0307-1
- SUSE Security Ratings
- SUSE Bug 1257301
- SUSE CVE CVE-2026-24486 page
Описание
Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename. Users should upgrade to version 0.0.22 to receive a patch or, as a workaround, avoid using `UPLOAD_KEEP_FILENAME=True` in project configurations.
Затронутые продукты
openSUSE Leap 15.6:python311-python-multipart-0.0.9-150600.3.6.1
Ссылки
- CVE-2026-24486
- SUSE Bug 1257301