diff --git a/requirements.txt b/requirements.txt
index 2fdbabb..060c3fe 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,7 +1,7 @@
 fastapi==0.115.0
 uvicorn[standard]==0.30.6
 anthropic>=0.40.0
-python-multipart==0.0.22    # >=0.0.22 fixes CVE-2026-24486 (path traversal arbitrary file write)
+python-multipart==0.0.26    # >=0.0.22 fixes CVE-2026-24486 (path traversal arbitrary file write)
 aiofiles==24.1.0
 jinja2==3.1.6               # >=3.1.5 fixes sandbox breakout CVEs
 slowapi==0.1.9