Python-Multipart 0.0.22 - Path Traversal

ExploitDBExploitDB exploitExploitEDB-52543

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that sends HTTP multipart POST requests with path traversal filenames to a target upload endpoint, attempting to write files to arbitrary filesystem locations.

Backdoor review

No backdoor observed in reviewed code

The PoC script is a straightforward path traversal exploit for CVE-2026-24486. It sends HTTP POST requests with malicious filenames to a target server. No backdoor, deceptive payload, persistence mechanism, or unrelated remote access is present. The script's behavior is limited to demonstrating the vulnerability.

ClassificationExploit
Model confidence95%
AuthenticationNot required
Languagespython
Target softwarepython-multipart
Attack typespath traversalarbitrary file write
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends crafted requests designed to write files outside the intended upload directory, which is the definition of an exploit. It does not merely check for the vulnerability; it attempts to exercise it.

exploits/python/webapps/52543.py:1exploits/python/webapps/52543.py:10-14exploits/python/webapps/52543.py:50-54

Requirements

  • Target server must be running python-multipart with UPLOAD_KEEP_FILENAME=True and UPLOAD_DIR configured.exploits/python/webapps/52543.py:11-12
  • Attacker must have network access to the target upload endpoint.exploits/python/webapps/52543.py:22
  • Local source file /etc/hosts must exist on the attacker machine.exploits/python/webapps/52543.py:23-27

Observed behavior

  • Reads a local file (/etc/hosts) and sends it as the content of a multipart file upload with a malicious filename containing path traversal sequences.exploits/python/webapps/52543.py:23exploits/python/webapps/52543.py:50-54
  • Iterates over a list of payload filenames including absolute paths, relative traversal sequences, null byte injection, and double slashes.exploits/python/webapps/52543.py:30-39exploits/python/webapps/52543.py:46
  • Prints HTTP response status and body for each attempt, and provides post-exploitation verification commands.exploits/python/webapps/52543.py:56-60exploits/python/webapps/52543.py:68-70
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Target Url
http://localhost:8000/uploadThe script targets a local server, which is typical for a PoC demonstration.exploits/python/webapps/52543.py:22
Payload List
['/tmp/poc-abs.txt', '/etc/poc-etc.txt', '/root/poc-root.txt', '../../var/www/html/shell.php', '../../etc/profile.d/mal.sh', '../../../tmp/poc-deep.txt', '../../etc/passwd%00.txt', '//etc//poc-double-slash.txt']The list of filenames used in the exploit, all designed to test path traversal. The filenames are part of the vulnerability demonstration.exploits/python/webapps/52543.py:30-38
Verification Command
docker exec -it vuln-poc find / -name '*poc*' -o -name '*shell*' 2>/dev/nullA post-exploit command printed for the user to manually verify the file writes in a Docker container. This is a manual verification step, not an automated backdoor action.exploits/python/webapps/52543.py:70
Review boundaries

What the analysis did not establish

  • Only the exploit script is provided; the vulnerable server application is not included.
  • The script's actual effectiveness cannot be verified without a running target instance.
  • The script uses hardcoded target URL and source file; it may require modification for different environments.
  • The review is limited to the provided text of the exploit script. No external libraries (e.g., 'requests') or the target server's behavior were analyzed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1