5.9

CVE-2026-12345

Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory

The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flags may still be reset outside of the tree on all platforms.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerPython Software Foundation
≫
Produkt CPython
Default Statusunaffected
Version 0
Version < 3.12.15
Status affected
Version 3.15.0a1
Version < 3.15.0rc3
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.18% 0.068
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
cna@python.org 5.9 0 0
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-59 Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

https://github.com/python/cpython/pull/157580
https://github.com/python/cpython/issues/157579
https://github.com/python/cpython/commit/5c20517a4fc56683efe63a7751020db9573f538d
http://www.openwall.com/lists/oss-security/2026/09/29/40
https://github.com/python/cpython/commit/458e7134a5af7f86aee9d21b51cf499b41aa4420
https://github.com/python/cpython/commit/e1f3590f155c6d66007e958c98c9d69316551993
https://github.com/python/cpython/commit/06ef3d43fdaf4da97af12fa694b4886092c4b970