client_key = app.config['CONSUMER_KEY']
client_secret = app.config['CONSUMER_SECRET']

session = OAuth1Session(client_key,
                        client_secret=client_secret,
                        resource_owner_key=session['owner_key'],
                        resource_owner_secret=session['owner_secret'])
                        
url = "https://commons.wikimedia.org/w/api.php"# I have used "https://test.wikipedia.org/w/api.php" with the same result

crsf_token = get_token()

params = {
    "action": "upload",
    "filename": <filename>,
    "format": "json",
    "token": csrf_token,
    "ignorewarnings": 1
}

file = {'file': (<filename>, open(<filepath>, 'rb'), 'multipart/form-data')}

response = session.post(url, files=file, data=params)
data = response.json()

return data

{
"error":
  {
    "code":"permissiondenied",
    "docref":"See https://commons.wikimedia.org/w/api.php for API usage. Subscribe to the mediawiki-api-announce mailing list at <https://lists.wikimedia.org/mailman/listinfo/mediawiki-api-announce> for notice of API deprecations and breaking changes.",
    "info":"The action you have requested is limited to users in one of the groups: *, [[Commons:Users|Users]]."
  },
  "servedby":"mw1278"
}