Python-Multipart, a multipart parser used in Python web projects, contains a Path Traversal flaw when its non-default settings allow the original file name to be preserved. The flaw enables an attacker to craft a malicious file name and cause the parser to write the uploaded content to an arbitrary path on the host system. This can lead to overwriting or creating critical files, potentially affecting confidentiality, integrity, or availability. The weakness is classified as CWE‑22, a classic file path manipulation vulnerability.

The vendor of this package is Kludex, with the product named python‑multipart. Software using earlier releases of python‑multipart before version 0.0.22 is affected. The affected configuration relies on an explicit UPLOAD_DIR and the flag UPLOAD_KEEP_FILENAME set to true. The Common Platform Enumeration indicates use in Python environments, typically within the FastAPI ecosystem.

The scoring model gives a CVSS score of 8.6, indicating high severity, while the EPSS score is less than 1%, suggesting a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector would involve uploading a crafted multipart payload to a service that has enabled the risky configuration, allowing the attacker to write files wherever the process has permission. Although exploitation is currently unlikely, the potential impact of arbitrary write and the high severity mean it should be treated with priority.