1119 lines
53 KiB
JSON
1119 lines
53 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-24486",
|
|
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "GitHub_M",
|
|
"dateReserved": "2026-01-23T00:38:20.548Z",
|
|
"datePublished": "2026-01-27T00:34:06.229Z",
|
|
"dateUpdated": "2026-09-16T12:04:19.486Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"title": "Python-Multipart has Arbitrary File Write via Non-Default Configuration",
|
|
"problemTypes": [
|
|
{
|
|
"descriptions": [
|
|
{
|
|
"cweId": "CWE-22",
|
|
"lang": "en",
|
|
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
|
|
"type": "CWE"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"attackComplexity": "LOW",
|
|
"attackVector": "NETWORK",
|
|
"availabilityImpact": "LOW",
|
|
"baseScore": 8.6,
|
|
"baseSeverity": "HIGH",
|
|
"confidentialityImpact": "LOW",
|
|
"integrityImpact": "HIGH",
|
|
"privilegesRequired": "NONE",
|
|
"scope": "UNCHANGED",
|
|
"userInteraction": "NONE",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
|
|
"version": "3.1"
|
|
}
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"name": "https://github.com/Kludex/python-multipart/security/advisories/GHSA-wp53-j4wj-2cfg",
|
|
"tags": [
|
|
"x_refsource_CONFIRM"
|
|
],
|
|
"url": "https://github.com/Kludex/python-multipart/security/advisories/GHSA-wp53-j4wj-2cfg"
|
|
},
|
|
{
|
|
"name": "https://github.com/Kludex/python-multipart/commit/9433f4bbc9652bdde82bbe380984e32f8cfc89c4",
|
|
"tags": [
|
|
"x_refsource_MISC"
|
|
],
|
|
"url": "https://github.com/Kludex/python-multipart/commit/9433f4bbc9652bdde82bbe380984e32f8cfc89c4"
|
|
},
|
|
{
|
|
"name": "https://github.com/Kludex/python-multipart/releases/tag/0.0.22",
|
|
"tags": [
|
|
"x_refsource_MISC"
|
|
],
|
|
"url": "https://github.com/Kludex/python-multipart/releases/tag/0.0.22"
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"vendor": "Kludex",
|
|
"product": "python-multipart",
|
|
"versions": [
|
|
{
|
|
"version": "< 0.0.22",
|
|
"status": "affected"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"providerMetadata": {
|
|
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
|
|
"shortName": "GitHub_M",
|
|
"dateUpdated": "2026-01-27T00:34:06.229Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename. Users should upgrade to version 0.0.22 to receive a patch or, as a workaround, avoid using `UPLOAD_KEEP_FILENAME=True` in project configurations."
|
|
}
|
|
],
|
|
"source": {
|
|
"advisory": "GHSA-wp53-j4wj-2cfg",
|
|
"discovery": "UNKNOWN"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"timestamp": "2026-01-27T20:50:56.753228Z",
|
|
"id": "CVE-2026-24486",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "partial"
|
|
}
|
|
],
|
|
"role": "CISA Coordinator",
|
|
"version": "2.0.3"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2026-01-27T20:51:06.407Z"
|
|
}
|
|
},
|
|
{
|
|
"affected": [
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:ai_inference_server:3.2::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "rhaiis/vllm-cuda-rhel9",
|
|
"product": "Red Hat AI Inference Server 3.2",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1772160593",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:ai_inference_server:3.2::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "rhaiis/vllm-rocm-rhel9",
|
|
"product": "Red Hat AI Inference Server 3.2",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1772160625",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "ansible-automation-platform-26/lightspeed-chatbot-rhel9",
|
|
"product": "Red Hat Ansible Automation Platform 2.6",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1772204398",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "ansible-automation-platform-26/mcp-tools-rhel9",
|
|
"product": "Red Hat Ansible Automation Platform 2.6",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1772429277",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_ai:2.25::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "rhoai/odh-feature-server-rhel9",
|
|
"product": "Red Hat OpenShift AI 2.25",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1776338381",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_ai:2.25::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "rhoai/odh-vllm-cpu-rhel9",
|
|
"product": "Red Hat OpenShift AI 2.25",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1776259063",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_ai:2.25::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "rhoai/odh-vllm-gaudi-rhel9",
|
|
"product": "Red Hat OpenShift AI 2.25",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1772093278",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_ai:2.25::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "rhoai/odh-vllm-cuda-rhel9",
|
|
"product": "Red Hat OpenShift AI 2.25",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1783998774",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_ai:2.25::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "rhoai/odh-vllm-rocm-rhel9",
|
|
"product": "Red Hat OpenShift AI 2.25",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1783998857",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_ai:3.3::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "rhoai/odh-vllm-cpu-rhel9",
|
|
"product": "Red Hat OpenShift AI 3.3",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1778264363",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_ai:3.3::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "rhoai/odh-vllm-gaudi-rhel9",
|
|
"product": "Red Hat OpenShift AI 3.3",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1770956034",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:satellite:6.17::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "satellite/iop-advisor-engine-rhel9",
|
|
"product": "Red Hat Satellite 6.17",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1784834402",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:satellite:6.18::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "satellite/foreman-mcp-server-rhel9",
|
|
"product": "Red Hat Satellite 6.18",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1769520238",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:satellite:6.18::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "satellite/iop-vulnerability-engine-rhel9",
|
|
"product": "Red Hat Satellite 6.18",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1784554123",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:lightspeed_core"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "lightspeed-core/lightspeed-stack-rhel9",
|
|
"product": "Lightspeed Core",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_lightspeed"
|
|
],
|
|
"defaultStatus": "unaffected",
|
|
"packageName": "openshift-lightspeed/lightspeed-ocp-rag-rhel9",
|
|
"product": "OpenShift Lightspeed",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_lightspeed"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "openshift-lightspeed/lightspeed-service-api-rhel9",
|
|
"product": "OpenShift Lightspeed",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:ai_inference_server:3"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "rhaiis/vllm-spyre-rhel9",
|
|
"product": "Red Hat AI Inference Server",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:ai_inference_server:3"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "rhaiis/vllm-tpu-rhel9",
|
|
"product": "Red Hat AI Inference Server",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:ansible_automation_platform:2"
|
|
],
|
|
"defaultStatus": "unaffected",
|
|
"packageName": "ansible-automation-platform-24/de-minimal-rhel8",
|
|
"product": "Red Hat Ansible Automation Platform 2",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:ansible_automation_platform:2"
|
|
],
|
|
"defaultStatus": "unaffected",
|
|
"packageName": "ansible-automation-platform-24/de-minimal-rhel9",
|
|
"product": "Red Hat Ansible Automation Platform 2",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:ansible_automation_platform:2"
|
|
],
|
|
"defaultStatus": "unaffected",
|
|
"packageName": "ansible-automation-platform-24/de-supported-rhel8",
|
|
"product": "Red Hat Ansible Automation Platform 2",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:ansible_automation_platform:2"
|
|
],
|
|
"defaultStatus": "unaffected",
|
|
"packageName": "ansible-automation-platform-24/de-supported-rhel9",
|
|
"product": "Red Hat Ansible Automation Platform 2",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:ansible_automation_platform:2"
|
|
],
|
|
"defaultStatus": "unaffected",
|
|
"packageName": "ansible-automation-platform-24/ee-minimal-rhel8",
|
|
"product": "Red Hat Ansible Automation Platform 2",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:ansible_automation_platform:2"
|
|
],
|
|
"defaultStatus": "unaffected",
|
|
"packageName": "ansible-automation-platform-24/ee-minimal-rhel9",
|
|
"product": "Red Hat Ansible Automation Platform 2",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:ansible_automation_platform:2"
|
|
],
|
|
"defaultStatus": "unaffected",
|
|
"packageName": "ansible-automation-platform-24/ee-supported-rhel8",
|
|
"product": "Red Hat Ansible Automation Platform 2",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:ansible_automation_platform:2"
|
|
],
|
|
"defaultStatus": "unaffected",
|
|
"packageName": "ansible-automation-platform-24/ee-supported-rhel9",
|
|
"product": "Red Hat Ansible Automation Platform 2",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:ansible_automation_platform:2"
|
|
],
|
|
"defaultStatus": "unaffected",
|
|
"packageName": "ansible-automation-platform-24/lightspeed-rhel8",
|
|
"product": "Red Hat Ansible Automation Platform 2",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:ansible_automation_platform:2"
|
|
],
|
|
"defaultStatus": "unaffected",
|
|
"packageName": "ansible-automation-platform-24/platform-resource-runner-rhel8",
|
|
"product": "Red Hat Ansible Automation Platform 2",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:ansible_automation_platform:2"
|
|
],
|
|
"defaultStatus": "unaffected",
|
|
"packageName": "ansible-automation-platform-25/ansible-dev-tools-rhel8",
|
|
"product": "Red Hat Ansible Automation Platform 2",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:ansible_automation_platform:2"
|
|
],
|
|
"defaultStatus": "unaffected",
|
|
"packageName": "ansible-automation-platform-25/de-minimal-rhel8",
|
|
"product": "Red Hat Ansible Automation Platform 2",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:ansible_automation_platform:2"
|
|
],
|
|
"defaultStatus": "unaffected",
|
|
"packageName": "ansible-automation-platform-25/de-minimal-rhel9",
|
|
"product": "Red Hat Ansible Automation Platform 2",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:ansible_automation_platform:2"
|
|
],
|
|
"defaultStatus": "unaffected",
|
|
"packageName": "ansible-automation-platform-25/de-supported-rhel8",
|
|
"product": "Red Hat Ansible Automation Platform 2",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:ansible_automation_platform:2"
|
|
],
|
|
"defaultStatus": "unaffected",
|
|
"packageName": "ansible-automation-platform-25/de-supported-rhel9",
|
|
"product": "Red Hat Ansible Automation Platform 2",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:ansible_automation_platform:2"
|
|
],
|
|
"defaultStatus": "unaffected",
|
|
"packageName": "ansible-automation-platform-25/ee-minimal-rhel8",
|
|
"product": "Red Hat Ansible Automation Platform 2",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:ansible_automation_platform:2"
|
|
],
|
|
"defaultStatus": "unaffected",
|
|
"packageName": "ansible-automation-platform-25/ee-minimal-rhel9",
|
|
"product": "Red Hat Ansible Automation Platform 2",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:ansible_automation_platform:2"
|
|
],
|
|
"defaultStatus": "unaffected",
|
|
"packageName": "ansible-automation-platform-25/ee-supported-rhel8",
|
|
"product": "Red Hat Ansible Automation Platform 2",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:ansible_automation_platform:2"
|
|
],
|
|
"defaultStatus": "unaffected",
|
|
"packageName": "ansible-automation-platform-25/ee-supported-rhel9",
|
|
"product": "Red Hat Ansible Automation Platform 2",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:ansible_automation_platform:2"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "ansible-automation-platform-25/lightspeed-chatbot-rhel8",
|
|
"product": "Red Hat Ansible Automation Platform 2",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:ansible_automation_platform:2"
|
|
],
|
|
"defaultStatus": "unaffected",
|
|
"packageName": "ansible-automation-platform-25/lightspeed-rhel8",
|
|
"product": "Red Hat Ansible Automation Platform 2",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:ansible_automation_platform:2"
|
|
],
|
|
"defaultStatus": "unaffected",
|
|
"packageName": "ansible-automation-platform-25/platform-resource-runner-rhel8",
|
|
"product": "Red Hat Ansible Automation Platform 2",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:ansible_automation_platform:2"
|
|
],
|
|
"defaultStatus": "unaffected",
|
|
"packageName": "ansible-automation-platform-26/ansible-dev-tools-rhel9",
|
|
"product": "Red Hat Ansible Automation Platform 2",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:ansible_automation_platform:2"
|
|
],
|
|
"defaultStatus": "unaffected",
|
|
"packageName": "ansible-automation-platform-26/de-minimal-rhel9",
|
|
"product": "Red Hat Ansible Automation Platform 2",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:ansible_automation_platform:2"
|
|
],
|
|
"defaultStatus": "unaffected",
|
|
"packageName": "ansible-automation-platform-26/de-supported-rhel9",
|
|
"product": "Red Hat Ansible Automation Platform 2",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:ansible_automation_platform:2"
|
|
],
|
|
"defaultStatus": "unaffected",
|
|
"packageName": "ansible-automation-platform-26/ee-minimal-rhel9",
|
|
"product": "Red Hat Ansible Automation Platform 2",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:ansible_automation_platform:2"
|
|
],
|
|
"defaultStatus": "unaffected",
|
|
"packageName": "ansible-automation-platform-26/ee-supported-rhel9",
|
|
"product": "Red Hat Ansible Automation Platform 2",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:ansible_automation_platform:2"
|
|
],
|
|
"defaultStatus": "unaffected",
|
|
"packageName": "ansible-automation-platform-26/lightspeed-rhel9",
|
|
"product": "Red Hat Ansible Automation Platform 2",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:ansible_automation_platform:2"
|
|
],
|
|
"defaultStatus": "unaffected",
|
|
"packageName": "ansible-automation-platform-26/platform-resource-runner-rhel9",
|
|
"product": "Red Hat Ansible Automation Platform 2",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:ansible_automation_platform:2"
|
|
],
|
|
"defaultStatus": "unaffected",
|
|
"packageName": "ansible-automation-platform/ee-minimal-rhel8",
|
|
"product": "Red Hat Ansible Automation Platform 2",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:ansible_automation_platform:2"
|
|
],
|
|
"defaultStatus": "unaffected",
|
|
"packageName": "ansible-automation-platform/ee-minimal-rhel9",
|
|
"product": "Red Hat Ansible Automation Platform 2",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:enterprise_linux_ai:3"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "rhelai3/bootc-aws-cuda-rhel9",
|
|
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:enterprise_linux_ai:3"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "rhelai3/bootc-azure-cuda-rhel9",
|
|
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:enterprise_linux_ai:3"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "rhelai3/bootc-cuda-rhel9",
|
|
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:enterprise_linux_ai:3"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "rhelai3/bootc-gcp-cuda-rhel9",
|
|
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:enterprise_linux_ai:3"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "rhelai3/disk-image-cuda-rhel9",
|
|
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_ai"
|
|
],
|
|
"defaultStatus": "unaffected",
|
|
"packageName": "rhoai/odh-caikit-nlp-rhel9",
|
|
"product": "Red Hat OpenShift AI (RHOAI)",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_ai"
|
|
],
|
|
"defaultStatus": "unaffected",
|
|
"packageName": "rhoai/odh-caikit-tgis-serving-rhel9",
|
|
"product": "Red Hat OpenShift AI (RHOAI)",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_ai"
|
|
],
|
|
"defaultStatus": "unaffected",
|
|
"packageName": "rhoai/odh-kserve-agent-rhel9",
|
|
"product": "Red Hat OpenShift AI (RHOAI)",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_ai"
|
|
],
|
|
"defaultStatus": "unaffected",
|
|
"packageName": "rhoai/odh-kserve-controller-rhel9",
|
|
"product": "Red Hat OpenShift AI (RHOAI)",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_ai"
|
|
],
|
|
"defaultStatus": "unaffected",
|
|
"packageName": "rhoai/odh-kserve-router-rhel9",
|
|
"product": "Red Hat OpenShift AI (RHOAI)",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_ai"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "rhoai/odh-kserve-storage-initializer-rhel9",
|
|
"product": "Red Hat OpenShift AI (RHOAI)",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_ai"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "rhoai/odh-llama-stack-core-rhel9",
|
|
"product": "Red Hat OpenShift AI (RHOAI)",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_ai"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "rhoai/odh-trustyai-ragas-lls-provider-dsp-rhel9",
|
|
"product": "Red Hat OpenShift AI (RHOAI)",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:satellite:6"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "satellite/iop-host-inventory-rhel9",
|
|
"product": "Red Hat Satellite 6",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:satellite:6"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "satellite/iop-vmaas-rhel9",
|
|
"product": "Red Hat Satellite 6",
|
|
"vendor": "Red Hat"
|
|
}
|
|
],
|
|
"datePublic": "2026-01-27T00:34:06.229Z",
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "A flaw was found in Python-Multipart, a tool for parsing multipart form data in Python applications. This vulnerability, known as path traversal, allows a remote attacker to write uploaded files to any location on the server's file system. This exploitation occurs when specific non-default configuration options, `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`, are enabled, and a malicious filename is provided during a file upload. The primary consequence is unauthorized file creation or modification, which could lead to system compromise."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"content": {
|
|
"namespace": "https://access.redhat.com/security/updates/classification/",
|
|
"value": "Important"
|
|
},
|
|
"type": "Red Hat severity rating"
|
|
}
|
|
},
|
|
{
|
|
"cvssV3_1": {
|
|
"attackComplexity": "LOW",
|
|
"attackVector": "NETWORK",
|
|
"availabilityImpact": "LOW",
|
|
"baseScore": 8.6,
|
|
"baseSeverity": "HIGH",
|
|
"confidentialityImpact": "LOW",
|
|
"integrityImpact": "HIGH",
|
|
"privilegesRequired": "NONE",
|
|
"scope": "UNCHANGED",
|
|
"userInteraction": "NONE",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
|
|
"version": "3.1"
|
|
},
|
|
"format": "CVSS"
|
|
}
|
|
],
|
|
"problemTypes": [
|
|
{
|
|
"descriptions": [
|
|
{
|
|
"cweId": "CWE-22",
|
|
"description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
|
|
"lang": "en",
|
|
"type": "CWE"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"tags": [
|
|
"vdb-entry",
|
|
"x_refsource_REDHAT"
|
|
],
|
|
"url": "https://access.redhat.com/security/cve/CVE-2026-24486"
|
|
},
|
|
{
|
|
"name": "RHBZ#2433132",
|
|
"tags": [
|
|
"issue-tracking",
|
|
"x_refsource_REDHAT"
|
|
],
|
|
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433132"
|
|
},
|
|
{
|
|
"tags": [
|
|
"x_sadp-csaf-vex"
|
|
],
|
|
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24486.json"
|
|
},
|
|
{
|
|
"tags": [
|
|
"vendor-advisory",
|
|
"x_refsource_REDHAT"
|
|
],
|
|
"url": "https://access.redhat.com/errata/RHSA-2026:3461"
|
|
},
|
|
{
|
|
"tags": [
|
|
"vendor-advisory",
|
|
"x_refsource_REDHAT"
|
|
],
|
|
"url": "https://access.redhat.com/errata/RHSA-2026:3462"
|
|
},
|
|
{
|
|
"tags": [
|
|
"vendor-advisory",
|
|
"x_refsource_REDHAT"
|
|
],
|
|
"url": "https://access.redhat.com/errata/RHSA-2026:3960"
|
|
},
|
|
{
|
|
"tags": [
|
|
"vendor-advisory",
|
|
"x_refsource_REDHAT"
|
|
],
|
|
"url": "https://access.redhat.com/errata/RHSA-2026:10184"
|
|
},
|
|
{
|
|
"tags": [
|
|
"vendor-advisory",
|
|
"x_refsource_REDHAT"
|
|
],
|
|
"url": "https://access.redhat.com/errata/RHSA-2026:42644"
|
|
},
|
|
{
|
|
"tags": [
|
|
"vendor-advisory",
|
|
"x_refsource_REDHAT"
|
|
],
|
|
"url": "https://access.redhat.com/errata/RHSA-2026:3782"
|
|
},
|
|
{
|
|
"tags": [
|
|
"vendor-advisory",
|
|
"x_refsource_REDHAT"
|
|
],
|
|
"url": "https://access.redhat.com/errata/RHSA-2026:19712"
|
|
},
|
|
{
|
|
"tags": [
|
|
"vendor-advisory",
|
|
"x_refsource_REDHAT"
|
|
],
|
|
"url": "https://access.redhat.com/errata/RHSA-2026:3713"
|
|
},
|
|
{
|
|
"tags": [
|
|
"vendor-advisory",
|
|
"x_refsource_REDHAT"
|
|
],
|
|
"url": "https://access.redhat.com/errata/RHSA-2026:44696"
|
|
},
|
|
{
|
|
"tags": [
|
|
"vendor-advisory",
|
|
"x_refsource_REDHAT"
|
|
],
|
|
"url": "https://access.redhat.com/errata/RHSA-2026:1504"
|
|
},
|
|
{
|
|
"tags": [
|
|
"vendor-advisory",
|
|
"x_refsource_REDHAT"
|
|
],
|
|
"url": "https://access.redhat.com/errata/RHSA-2026:51357"
|
|
}
|
|
],
|
|
"solutions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "RHSA-2026:3461: Red Hat AI Inference Server 3.2"
|
|
},
|
|
{
|
|
"lang": "en",
|
|
"value": "RHSA-2026:3462: Red Hat AI Inference Server 3.2"
|
|
},
|
|
{
|
|
"lang": "en",
|
|
"value": "RHSA-2026:3960: Red Hat Ansible Automation Platform 2.6"
|
|
},
|
|
{
|
|
"lang": "en",
|
|
"value": "RHSA-2026:10184: Red Hat OpenShift AI 2.25"
|
|
},
|
|
{
|
|
"lang": "en",
|
|
"value": "RHSA-2026:42644: Red Hat OpenShift AI 2.25"
|
|
},
|
|
{
|
|
"lang": "en",
|
|
"value": "RHSA-2026:3782: Red Hat OpenShift AI 2.25"
|
|
},
|
|
{
|
|
"lang": "en",
|
|
"value": "RHSA-2026:19712: Red Hat OpenShift AI 3.3"
|
|
},
|
|
{
|
|
"lang": "en",
|
|
"value": "RHSA-2026:3713: Red Hat OpenShift AI 3.3"
|
|
},
|
|
{
|
|
"lang": "en",
|
|
"value": "RHSA-2026:44696: Red Hat Satellite 6.17"
|
|
},
|
|
{
|
|
"lang": "en",
|
|
"value": "RHSA-2026:1504: Red Hat Satellite 6.18"
|
|
},
|
|
{
|
|
"lang": "en",
|
|
"value": "RHSA-2026:51357: Red Hat Satellite 6.18"
|
|
}
|
|
],
|
|
"timeline": [
|
|
{
|
|
"lang": "en",
|
|
"time": "2026-01-27T01:00:58.032Z",
|
|
"value": "Reported to Red Hat."
|
|
},
|
|
{
|
|
"lang": "en",
|
|
"time": "2026-01-27T00:34:06.229Z",
|
|
"value": "Made public."
|
|
}
|
|
],
|
|
"title": "python-multipart: Python-Multipart: Arbitrary file write via path traversal vulnerability",
|
|
"workarounds": [
|
|
{
|
|
"lang": "en",
|
|
"value": "To mitigate this vulnerability, avoid enabling the `UPLOAD_KEEP_FILENAME=True` configuration option in applications using `python-multipart`. This option, when used with `UPLOAD_DIR`, allows an attacker to write files to arbitrary locations. Disabling or not configuring `UPLOAD_KEEP_FILENAME=True` prevents the path traversal vulnerability."
|
|
}
|
|
],
|
|
"x_adpType": "supplier",
|
|
"x_generator": {
|
|
"engine": "sadp-cli 1.0.0"
|
|
},
|
|
"providerMetadata": {
|
|
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
|
|
"shortName": "redhat-SADP",
|
|
"dateUpdated": "2026-09-16T12:04:19.486Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |