StackRadar

CVE-2026-24486

High

Advisory

Published 26 Jan 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
8.6
base score, highest
EPSS
0.022
81st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
47
of 17,781 indexed, latest versions
Container images
52
deployed by those charts
Fix available
1 of 1
affected package

Python-Multipart has Arbitrary File Write via Non-Default Configuration

Carried by container images the latest versions of 47 of 17,781 indexed charts deploy, on 52 images.

Affected packageAffected versionsFixed inImages
python-multipartpypi0.0.5, 0.0.6, 0.0.9, 0.0.18+3 more0.0.2252
OSV records
GHSA-wp53-j4wj-2cfg
Also known as
PYSEC-2026-1852

Charts affected

47 by stars
ChartLatestAffected imagesRadar Score
wazuhwazuh-helm-morgovedVerified publisher2.0.71 of 5See more

wazuh wazuh-helm-morgoved 2.0.7

1 of the 5 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
wazuh/wazuh-manager:4.14.3f09282d281f6
python-multipart@0.0.20
0.0.22

Open the chart page →

11,384
synapsehalkeye0.40.01 of 2See more

synapse halkeye 0.40.0

1 of the 2 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
ghcr.io/element-hq/synapse:v1.111.022ae556e0de4
python-multipart@0.0.9
0.0.22

Open the chart page →

6,543
syftopenmined0.9.51 of 6See more

syft openmined 0.9.5

1 of the 6 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
openmined/syft-backend:0.9.5b72f74a68b32
python-multipart@0.0.20
0.0.22

Open the chart page →

17,245
wazuhwazuh-helmVerified publisher0.0.81 of 4See more

wazuh wazuh-helm 0.0.8

1 of the 4 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
wazuh/wazuh-manager:4.11.11da5c38c6a78
python-multipart@0.0.9
0.0.22

Open the chart page →

6,168
mealiegeek-cookbookVerified publisher5.1.21 of 2See more

mealie geek-cookbook 5.1.2

1 of the 2 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
hkotel/mealie:api-v1.0.0beta-2a7e6b6abe087
python-multipart@0.0.5
0.0.22

Open the chart page →

7,579
mealieth-chartsVerified publisher0.5.11 of 1See more

mealie th-charts 0.5.1

1 of the 1 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.7.0bb2939094eed
python-multipart@0.0.20
0.0.22

Open the chart page →

3,804
clearml-servingallegroaiVerified publisher1.6.21 of 9See more

clearml-serving allegroai 1.6.2

1 of the 9 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
allegroai/clearml-serving-inference:1.3.0fca885e8cfc6
python-multipart@0.0.6
0.0.22

Open the chart page →

17,877
rommcrystalnetVerified publisher0.2.201 of 3See more

romm crystalnet 0.2.20

1 of the 3 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
zurdi15/romm:2.3.12db88fe44c89
python-multipart@0.0.6
0.0.22

Open the chart page →

1,944
aibrixdanchevVerified publisher0.7.01 of 5See more

aibrix danchev 0.7.0

1 of the 5 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
aibrix/metadata-service:v0.7.063fb81a64377
python-multipart@0.0.20
0.0.22

Open the chart page →

5,274
helmuphelmupVerified publisher0.1.01 of 3See more

helmup helmup 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
sirrend/helmup-engine:0.1.13699e79e3d4e2
python-multipart@0.0.9
0.0.22

Open the chart page →

16,514
immichimmich-helm0.3.01 of 4See more

immich immich-helm 0.3.0

1 of the 4 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-machine-learning:v2.3.1379e31b8c751
python-multipart@0.0.20
0.0.22

Open the chart page →

15,712
jessejesse-chartVerified publisher0.0.461 of 6See more

jesse jesse-chart 0.0.46

1 of the 6 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
salehmir/jesse:1.10.101afa95f979e9
python-multipart@0.0.20
0.0.22

Open the chart page →

3,421
difykubeblocksVerified publisher0.5.11 of 5See more

dify kubeblocks 0.5.1

1 of the 5 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
langgenius/dify-api:0.6.11fca918260dd6
python-multipart@0.0.9
0.0.22

Open the chart page →

20,403
litellmlitellm-helm0.2.01 of 1See more

litellm litellm-helm 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
ghcr.io/berriai/litellm-database:litellm_stable_release_branch-v1.75.5-stableab63d26a8a2c
python-multipart@0.0.18
0.0.22

Open the chart page →

4,292
clowder2ncsaVerified publisher1.9.73 of 12See more

clowder2 ncsa 1.9.7

3 of the 12 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
clowder/clowder2-backend:2.0.0-beta.411f3d844e4c0
python-multipart@0.0.6
0.0.22
clowder/clowder2-heartbeat:2.0.0-beta.414155326c7b9
python-multipart@0.0.6
0.0.22
clowder/clowder2-messages:2.0.0-beta.4bf146f1ca24f
python-multipart@0.0.6
0.0.22

Open the chart page →

37,373
mealiertomik-helm-chartsVerified publisher0.0.21 of 1See more

mealie rtomik-helm-charts 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.2.1322369a5b748
python-multipart@0.0.20
0.0.22

Open the chart page →

3,929
vuiseriohub1.0.61 of 3See more

vui seriohub 1.0.6

1 of the 3 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
dserio83/velero-api:0.3.16b3d9115fee2
python-multipart@0.0.19
0.0.22

Open the chart page →

11,532
flrepositorydbassist-iot-fl-repository1.1.01 of 2See more

flrepositorydb assist-iot-fl-repository 1.1.0

1 of the 2 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
assistiot/fl_repository:latest0fce3ea719a5
python-multipart@0.0.5
0.0.22

Open the chart page →

4,367
openapiassist-iot-open-api-management0.2.21 of 6See more

openapi assist-iot-open-api-management 0.2.2

1 of the 6 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
assistiot/open_api_backend:1.1.230812ba93555
python-multipart@0.0.6
0.0.22

Open the chart page →

18,277
pbcore-utilcluster-deploy0.0.11 of 1See more

pbcore-util cluster-deploy 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/pbcore-util:pr-66e04659a3baa
python-multipart@0.0.20
0.0.22

Open the chart page →

9,128
csghubcsghubVerified publisher2.4.32 of 34See more

csghub csghub 2.4.3

2 of the 34 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
opencsghq/agenticflow:ee-v0.6-52f03fead54db
python-multipart@0.0.20
0.0.22
opencsghq/csgbot:v0.6.7-eeaf7191a9cf8a
python-multipart@0.0.21
0.0.22

Open the chart page →

58,897
csgshipcsghubVerified publisher0.4.61 of 10See more

csgship csghub 0.4.6

1 of the 10 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
opencsghq/csgship-agentic:v0.4.02cd29671a03e
python-multipart@0.0.20
0.0.22

Open the chart page →

11,335
helpdeskdoubanVerified publisher0.3.31 of 2See more

helpdesk douban 0.3.3

1 of the 2 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
douz/helpdesk:latest4384103d0219
python-multipart@0.0.5
0.0.22

Open the chart page →

4,550
aerios-k8s-shimeclipse-aeriosVerified publisher1.0.01 of 1See more

aerios-k8s-shim eclipse-aerios 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
eclipseaerios/aerios-k8s-shim:v1.0.0d4ed3d8e5db4
python-multipart@0.0.9
0.0.22

Open the chart page →

1,434
rommernail-romm1.0.11 of 1See more

romm ernail-romm 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
rommapp/romm:4.4.1b909e95d1aab
python-multipart@0.0.20
0.0.22

Open the chart page →

2,896
huntingfactlyVerified publisher0.4.141 of 1See more

hunting factly 0.4.14

1 of the 1 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
factly/hunting:0.2.0-stagv1.2ca5bc71d1d5c
python-multipart@0.0.5
0.0.22

Open the chart page →

4,085
skypilotgeek-cookbookVerified publisher0.0.11 of 3See more

skypilot geek-cookbook 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
python-multipart@0.0.20
0.0.22

Open the chart page →

8,923
gwangju_2-3gwangju2-30.1.03 of 5See more

gwangju_2-3 gwangju2-3 0.1.0

3 of the 5 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
clsen2024/gwangju_2-3:service-b-10ba9eff852c5
python-multipart@0.0.9
0.0.22
clsen2024/gwangju_2-3:service-a-151b1d45961cd
python-multipart@0.0.9
0.0.22
clsen2024/gwangju_2-3:service-c-1efb1586c8299
python-multipart@0.0.9
0.0.22

Open the chart page →

6,491
notediscoveryhelmforgeVerified publisher2.0.11 of 1See more

notediscovery helmforge 2.0.1

1 of the 1 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
ghcr.io/gamosoft/notediscovery:0.31.5c06aa0fa9a85
python-multipart@0.0.6
0.0.22

Open the chart page →

1,241
graphiti-mcpkiberonlabs0.1.21 of 1See more

graphiti-mcp kiberonlabs 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
zepai/knowledge-graph-mcp:v0.2.16ab0ee79926b
python-multipart@0.0.20
0.0.22

Open the chart page →

3,393
pavkrzwiatrzyk0.0.31 of 1See more

pav krzwiatrzyk 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
witcherek7/pav:0.0.342a744f29ac0
python-multipart@0.0.5
0.0.22

Open the chart page →

1,132
aperagkubeblocksVerified publisher0.0.0-nightly1 of 3See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
python-multipart@0.0.20
0.0.22

Open the chart page →

8,405
nodecg-chartmarathon-charts0.1.51 of 2See more

nodecg-chart marathon-charts 0.1.5

1 of the 2 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
ghcr.io/rodg/rtmp-controller:latest67f99a5beab7
python-multipart@0.0.5
0.0.22

Open the chart page →

7,315
meerschaummeerschaumVerified publisher0.2.01 of 1See more

meerschaum meerschaum 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
bmeares/meerschaum:2.8.48e9c5bacaa82
python-multipart@0.0.20
0.0.22

Open the chart page →

5,823
MINTmint8.0.21 of 15See more

MINT mint 8.0.2

1 of the 15 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
mintproject/model-catalog-fastapi:7dd88dc5bf1fe6a6d4703ea0a077afee45cb256102260d20a21f
python-multipart@0.0.5
0.0.22

Open the chart page →

43,341
face-recognitionmoreillonVerified publisher0.2.41 of 3See more

face-recognition moreillon 0.2.4

1 of the 3 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
moreillon/face-recognition-fastapi:x86bacb2ddd8394
python-multipart@0.0.5
0.0.22

Open the chart page →

8,556
my-fastapi-chartmy-fastapi-template0.1.01 of 1See more

my-fastapi-chart my-fastapi-template 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
john19968010/fastapi-template:latest31a90f6bd69c
python-multipart@0.0.5
0.0.22

Open the chart page →

967
neurofaceneurofaceVerified publisher1.4.21 of 3See more

neuroface neuroface 1.4.2

1 of the 3 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
quay.io/maximilianopizarro/neuroface-backend:v1.4.13194d46df0f9
python-multipart@0.0.20
0.0.22

Open the chart page →

7,310
mockoidcoidcmockVerified publisher0.0.11 of 1See more

mockoidc oidcmock 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
marcoimme/oidcmock:latestb6035c0721a8
python-multipart@0.0.6
0.0.22

Open the chart page →

2,298
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.01 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

1 of the 40 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
yetiplatform/yeti:2.9.09bcbe2650a14
python-multipart@0.0.18
0.0.22

Open the chart page →

71,208
yetiosdfir-infrastructureVerified publisher1.0.51 of 4See more

yeti osdfir-infrastructure 1.0.5

1 of the 4 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
yetiplatform/yeti:latest9c3006cedcca
python-multipart@0.0.18
0.0.22

Open the chart page →

6,583
home-assistantpascaliskeVerified publisher0.1.11 of 1See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
python-multipart@0.0.21
0.0.22

Open the chart page →

4,749
prefect-agentprefectVerified publisher2024.8.301638221 of 1See more

prefect-agent prefect 2024.8.30163822

1 of the 1 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
prefecthq/prefect:2.20.4-python3.101df4b5b6238a
python-multipart@0.0.9
0.0.22

Open the chart page →

5,451
prompt-dbprompt-dbVerified publisher1.0.71 of 3See more

prompt-db prompt-db 1.0.7

1 of the 3 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
ghcr.io/erlkoenig91/prompt-db-backend:1.0.7ab120359810d
python-multipart@0.0.20
0.0.22

Open the chart page →

3,332
rhbk-neurofacerhbk-neurofaceVerified publisher1.0.01 of 4See more

rhbk-neuroface rhbk-neuroface 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
quay.io/maximilianopizarro/neuroface-backend:latestcba71dc08c8a
python-multipart@0.0.20
0.0.22

Open the chart page →

3,781
matrix-stackrock8sVerified publisher0.8.11 of 7See more

matrix-stack rock8s 0.8.1

1 of the 7 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
matrixdotorg/synapse:v1.127.1c3c4a9de2a0b
python-multipart@0.0.20
0.0.22

Open the chart page →

9,256
mealiesmarthallVerified publisher0.0.101 of 1See more

mealie smarthall 0.0.10

1 of the 1 container images this version deploys carry CVE-2026-24486.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v1.4.0b56da41cf178
python-multipart@0.0.9
0.0.22

Open the chart page →

5,565

Container images carrying it

52 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/maximilianopizarro/neuroface-backend:v1.4.13194d46df0f9
python-multipart@0.0.20
0.0.22
1
quay.io/maximilianopizarro/neuroface-backend:latestcba71dc08c8a
python-multipart@0.0.20
0.0.22
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.