CVE-2026-12345

EUVD-2026-89183

29.09.2026, 18:17

The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flags may still be reset outside of the tree on all platforms.

Link Following

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
PSF	CNA	5.9 MEDIUM	LOCAL	LOW	NONE	CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Base Score

CVSS 3.x

EPSS Score

Percentile: 28.34%

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).

Vendor	Product	Version	Source
python	cpython	𝑥 < 3.12.15	CNA
python	cpython	3.13.0 ≤ 𝑥 < 3.13.18	CNA
python	cpython	3.14.0 ≤ 𝑥 < 3.14.9	CNA

Debian Releases

Debian Product

Codename

pypy3

bookworm	postponed
forky	vulnerable
sid	vulnerable
trixie	no-dsa

python3.11

bookworm	postponed
bookworm (security)	vulnerable

python3.13

sid	3.13.18-1 fixed
trixie	no-dsa

python3.14

forky	3.14.10-1 fixed
sid	3.14.10-1 fixed

python3.15

forky	3.15.2-1 fixed
sid	3.15.2-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

python2.7

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	dne
resolute	dne
trusty	needs-triage
xenial	needs-triage

python3.4

jammy	dne
noble	dne
resolute	dne
trusty	needs-triage

python3.5

jammy	dne
noble	dne
resolute	dne
trusty	needs-triage
xenial	needs-triage

python3.6

bionic	needs-triage
jammy	dne
noble	dne
resolute	dne

python3.7

bionic	needs-triage
jammy	dne
noble	dne
resolute	dne

python3.8

bionic	needs-triage
focal	needs-triage
jammy	dne
noble	dne
resolute	dne

python3.9

focal	needs-triage
jammy	dne
noble	dne
resolute	dne

python3.10

jammy	needs-triage
noble	dne
resolute	dne

python3.11

jammy	needs-triage
noble	dne
resolute	dne

python3.12

jammy	dne
noble	needs-triage
resolute	dne

python3.14

jammy	dne
noble	dne
resolute	needs-triage

openSUSE / SLES Releases

openSUSE Product

Release

libpython3_6m1_0

suse enterprise server 12 SP3

3.6.15-6.171.1

fixed

python36

suse enterprise server 12 SP3

3.6.15-6.171.1

fixed

python36-base

suse enterprise server 12 SP3

3.6.15-6.171.1

fixed

python36-curses

suse enterprise server 12 SP3

3.6.15-6.171.1

fixed

python36-dbm

suse enterprise server 12 SP3

3.6.15-6.171.1

fixed

python36-devel

suse enterprise server 12 SP3

3.6.15-6.171.1

fixed

python36-idle

suse enterprise server 12 SP3

3.6.15-6.171.1

fixed

python36-testsuite

suse enterprise server 12 SP3

3.6.15-6.171.1

fixed

python36-tk

suse enterprise server 12 SP3

3.6.15-6.171.1

fixed

python36-tools

suse enterprise server 12 SP3

3.6.15-6.171.1

fixed

Red Hat Enterprise Linux Releases

Red Hat Product

Release

platform-python

RHEL 8

0:3.6.8-79.el8_10

fixed

platform-python-debug

RHEL 8

0:3.6.8-79.el8_10

fixed

platform-python-devel

RHEL 8

0:3.6.8-79.el8_10

fixed

python-unversioned-command

RHEL 9

0:3.9.25-14.el9_9

fixed

python3

RHEL 9

0:3.9.25-14.el9_9

fixed

python3-debug

RHEL 9

0:3.9.25-14.el9_9

fixed

python3-devel

RHEL 9

0:3.9.25-14.el9_9

fixed

python3-idle

RHEL 8	0:3.6.8-79.el8_10 fixed
RHEL 9	0:3.9.25-14.el9_9 fixed

python3-libs

RHEL 8	0:3.6.8-79.el8_10 fixed
RHEL 9	0:3.9.25-14.el9_9 fixed

python3-test

RHEL 8	0:3.6.8-79.el8_10 fixed
RHEL 9	0:3.9.25-14.el9_9 fixed

python3-tkinter

RHEL 8	0:3.6.8-79.el8_10 fixed
RHEL 9	0:3.9.25-14.el9_9 fixed

Amazon Linux Releases

Amazon Package

Release

python3.12

Amazon Linux 2023

0:3.12.16-2.amzn2023.0.1

fixed

python3.12-debug

Amazon Linux 2023

0:3.12.16-2.amzn2023.0.1

fixed

python3.12-debuginfo

Amazon Linux 2023

0:3.12.16-2.amzn2023.0.1

fixed

python3.12-debugsource

Amazon Linux 2023

0:3.12.16-2.amzn2023.0.1

fixed

python3.12-devel

Amazon Linux 2023

0:3.12.16-2.amzn2023.0.1

fixed

python3.12-idle

Amazon Linux 2023

0:3.12.16-2.amzn2023.0.1

fixed

python3.12-libs

Amazon Linux 2023

0:3.12.16-2.amzn2023.0.1

fixed

python3.12-test

Amazon Linux 2023

0:3.12.16-2.amzn2023.0.1

fixed

python3.12-tkinter

Amazon Linux 2023

0:3.12.16-2.amzn2023.0.1

fixed

python3.13

Amazon Linux 2023

0:3.13.18-1.amzn2023.0.1

fixed

python3.13-debug

Amazon Linux 2023

0:3.13.18-1.amzn2023.0.1

fixed

python3.13-debuginfo

Amazon Linux 2023

0:3.13.18-1.amzn2023.0.1

fixed

python3.13-debugsource

Amazon Linux 2023

0:3.13.18-1.amzn2023.0.1

fixed

python3.13-devel

Amazon Linux 2023

0:3.13.18-1.amzn2023.0.1

fixed

python3.13-freethreading

Amazon Linux 2023

0:3.13.18-1.amzn2023.0.1

fixed

python3.13-freethreading-debug

Amazon Linux 2023

0:3.13.18-1.amzn2023.0.1

fixed

python3.13-idle

Amazon Linux 2023

0:3.13.18-1.amzn2023.0.1

fixed

python3.13-libs

Amazon Linux 2023

0:3.13.18-1.amzn2023.0.1

fixed

python3.13-test

Amazon Linux 2023

0:3.13.18-1.amzn2023.0.1

fixed

python3.13-tkinter

Amazon Linux 2023

0:3.13.18-1.amzn2023.0.1

fixed

python3.14

Amazon Linux 2023

0:3.14.10-1.amzn2023.0.1

fixed

python3.14-debug

Amazon Linux 2023

0:3.14.10-1.amzn2023.0.1

fixed

python3.14-debuginfo

Amazon Linux 2023

0:3.14.10-1.amzn2023.0.1

fixed

python3.14-debugsource

Amazon Linux 2023

0:3.14.10-1.amzn2023.0.1

fixed

python3.14-devel

Amazon Linux 2023

0:3.14.10-1.amzn2023.0.1

fixed

python3.14-freethreading

Amazon Linux 2023

0:3.14.10-1.amzn2023.0.1

fixed

python3.14-freethreading-debug

Amazon Linux 2023

0:3.14.10-1.amzn2023.0.1

fixed

python3.14-freethreading-devel

Amazon Linux 2023

0:3.14.10-1.amzn2023.0.1

fixed

python3.14-freethreading-idle

Amazon Linux 2023

0:3.14.10-1.amzn2023.0.1

fixed

python3.14-freethreading-libs

Amazon Linux 2023

0:3.14.10-1.amzn2023.0.1

fixed

python3.14-freethreading-test

Amazon Linux 2023

0:3.14.10-1.amzn2023.0.1

fixed

python3.14-freethreading-tkinter

Amazon Linux 2023

0:3.14.10-1.amzn2023.0.1

fixed

python3.14-idle

Amazon Linux 2023

0:3.14.10-1.amzn2023.0.1

fixed

python3.14-libs

Amazon Linux 2023

0:3.14.10-1.amzn2023.0.1

fixed

python3.14-test

Amazon Linux 2023

0:3.14.10-1.amzn2023.0.1

fixed

python3.14-tkinter

Amazon Linux 2023

0:3.14.10-1.amzn2023.0.1

fixed

Azure Linux Releases

Azure Package

Release

python3

Azure Linux 3.0

0:3.12.16-1.azl3

fixed

Common Weakness Enumeration

CWE-59 - Improper Link Resolution Before File Access ('Link Following')
The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Vulnerability Media Exposure

[GERMAN] CPython: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen und Manipulation von Dateien
Ein lokaler Angreifer kann eine Schwachstelle in CPython ausnutzen, um Sicherheitsvorkehrungen zu umgehen und um Dateien zu manipulieren.
Published: 2026-09-29T22:00:00+00:00

References

https://github.com/python/cpython/commit/0478b52788117db4b831b3efd648f56b777628aa

https://github.com/python/cpython/commit/06ef3d43fdaf4da97af12fa694b4886092c4b970

https://github.com/python/cpython/commit/458e7134a5af7f86aee9d21b51cf499b41aa4420

https://github.com/python/cpython/commit/58ed0259cae509a19138795df302fe60b544dc74

https://github.com/python/cpython/commit/5c20517a4fc56683efe63a7751020db9573f538d

https://github.com/python/cpython/commit/c39b52d00b42200aaadff679e2fe3f1006d57c58

https://github.com/python/cpython/commit/e1f3590f155c6d66007e958c98c9d69316551993

https://github.com/python/cpython/issues/157579

https://github.com/python/cpython/pull/157580

http://www.openwall.com/lists/oss-security/2026/09/29/40