CVE-2026-53537

Name of the Vulnerable Software and Affected Versions Python-Multipart versions prior to 0.0.30

Description The parse options header function parsed Content-Disposition and Content-Type headers using email.message.Message, which applies RFC 2231/5987 decoding. This allows extended parameter syntax, such as filename*, name*, and continuation forms (filename*0, filename*1), to override plain parameters when both are present. However, RFC 7578 §4.2 explicitly forbids the filename* form in multipart/form-data.

This creates an interpretation conflict where upstream components (such as WAFs, proxies, or gateways) that follow RFC 7578 or do not implement RFC 2231/5987 decoding may interpret headers differently than the backend. An attacker can exploit this to smuggle a different field name or filename past an inspector. This affects the parse options header, FormParser, create form parser, and parse form APIs, and impacts Starlette/FastAPI via request.form(), exposing smuggled values as form field names or UploadFile.filename.

Potential consequences include bypassing access or upload controls based on field names or filenames, and path traversal if the application builds filesystem paths from the parsed filename without sanitization, as percent-encoded sequences like ..%2F are decoded.

Recommendations Update to version 0.0.30 or later.