CVE-2026-8643

EUVD-2026-33682
pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.5 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 24.4%
Affected Products (NVD)
VendorProductVersion
pypapip
𝑥
< 26.1.2
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 8
0:4.6.30-2.el8ap ≤
𝑥
< *
ADP
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 9
0:4.6.30-2.el9ap ≤
𝑥
< *
ADP
Red HatRed Hat Ansible Automation Platform 2.6 for RHEL 9
0:4.7.14-3.el9ap ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 10
0:25.2-3.el10_2.5 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9
0:25.2-3.el9_8.5 ≤
𝑥
< *
ADP
Red HatRed Hat Ansible Automation Platform 2.5
1784049109 ≤
𝑥
< *
ADP
Red HatRed Hat Ansible Automation Platform 2.6
1782711769 ≤
𝑥
< *
ADP
Red HatRed Hat Ansible Automation Platform 2.6
1782713671 ≤
𝑥
< *
ADP
Red HatRed Hat Ansible Automation Platform 2.6
1782761510 ≤
𝑥
< *
ADP
Red HatRed Hat Ansible Automation Platform 2.6
1783969139 ≤
𝑥
< *
ADP
Red HatRed Hat Ansible Automation Platform 2.6
1785753810 ≤
𝑥
< *
ADP
Red HatRed Hat Discovery 2
1782763840 ≤
𝑥
< *
ADP
Red HatRed Hat Discovery 2
1786638573 ≤
𝑥
< *
ADP
Red HatRed Hat Hardened Images
26.1.1-3.1.hum1 ≤
𝑥
< *
ADP
Red HatRed Hat Hardened Images
26.1.2-1.hum1 ≤
𝑥
< *
ADP
Red HatRed Hat Migration Toolkit for Applications 8.2
1786481481 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 2.25
1783082430 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 2.25
1783024305 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 2.25
1783342900 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 2.25
1783998418 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 2.25
1783998418 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 2.25
1782475830 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 2.25
1782475830 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.0
1782929133 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.0
1782928984 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.0
1782968171 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.0
1782929069 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.0
1782928977 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.2
1782915416 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.2
1782915184 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.2
1782914833 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.2
1782914721 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.2
1782914751 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.2
1782914629 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.3
1782915056 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.3
1782916020 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.3
1782914960 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.3
1782914644 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.3
1782914706 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.3
1782915015 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.3
1782914779 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.3
1782914653 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.3
1783010225 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.3
1782887848 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.3
1782471555 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.3
1782471579 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.3
1783073038 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.3
1782991170 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.3
1782471656 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.3
1782471663 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.3
1783069204 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.3
1782991170 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.4
1782133213 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.4
1782726504 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.4
1782135464 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.4
1782136276 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.4
1782135346 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.4
1782132167 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.4
1782132207 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.4
1782132237 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.4
1782132240 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.4
1782132286 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.4
1782132236 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.4
1782132163 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.4
1782132297 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.4
1786612415 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.4
1786612637 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.4
1786635926 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.4
1787073866 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.4
1787073936 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.4
1787073873 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.4
1787073459 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.4
1787073611 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.4
1787073451 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.4
1787073451 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.4
1786613209 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.4
1787121387 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.4
1787074331 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.4
1787073913 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.4
1787074078 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.4
1787073929 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.4
1787073605 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.4
1787073546 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.4
1787073717 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.4
1787073713 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 3.4
1787073593 ≤
𝑥
< *
ADP
Red HatRed Hat Trusted Artifact Signer 1.4
1782485441 ≤
𝑥
< *
ADP
Debian logo
Debian Releases
Debian Product
Codename
python-pip
bookworm
no-dsa
bullseye
postponed
bullseye (security)
vulnerable
forky
26.1.2+dfsg-1
fixed
sid
26.1.2+dfsg-1
fixed
trixie
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
python-pip
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
questing
ignored
resolute
needs-triage
trusty
needs-triage
xenial
needs-triage
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libpython2_7-1_0
suse enterprise sap 12 SP5
2.7.18-33.82.1
fixed
suse enterprise server 12 SP5
2.7.18-33.82.1
fixed
libpython2_7-1_0-32bit
suse enterprise sap 12 SP5
2.7.18-33.82.1
fixed
suse enterprise server 12 SP5
2.7.18-33.82.1
fixed
libpython3_4m1_0
suse enterprise sap 12 SP5
3.4.10-25.191.2
fixed
suse enterprise server 12 SP3
3.4.10-25.191.2
fixed
suse enterprise server 12 SP5
3.4.10-25.191.2
fixed
libpython3_4m1_0-32bit
suse enterprise sap 12 SP5
3.4.10-25.191.2
fixed
suse enterprise server 12 SP5
3.4.10-25.191.2
fixed
libpython3_6m1_0
suse enterprise sap 12 SP5
3.6.15-116.1
fixed
suse enterprise server 12 SP3
3.6.15-6.159.1
fixed
suse enterprise server 12 SP5
3.6.15-116.1
fixed
libpython3_6m1_0-32bit
suse enterprise sap 12 SP5
3.6.15-116.1
fixed
suse enterprise server 12 SP5
3.6.15-116.1
fixed
python
suse enterprise sap 12 SP5
2.7.18-33.82.1
fixed
suse enterprise server 12 SP5
2.7.18-33.82.1
fixed
python-32bit
suse enterprise sap 12 SP5
2.7.18-33.82.1
fixed
suse enterprise server 12 SP5
2.7.18-33.82.1
fixed
python-base
suse enterprise sap 12 SP5
2.7.18-33.82.1
fixed
suse enterprise server 12 SP5
2.7.18-33.82.1
fixed
python-base-32bit
suse enterprise sap 12 SP5
2.7.18-33.82.1
fixed
suse enterprise server 12 SP5
2.7.18-33.82.1
fixed
python-curses
suse enterprise sap 12 SP5
2.7.18-33.82.1
fixed
suse enterprise server 12 SP5
2.7.18-33.82.1
fixed
python-demo
suse enterprise sap 12 SP5
2.7.18-33.82.1
fixed
suse enterprise server 12 SP5
2.7.18-33.82.1
fixed
python-devel
suse enterprise sap 12 SP5
2.7.18-33.82.1
fixed
suse enterprise server 12 SP5
2.7.18-33.82.1
fixed
python-doc
suse enterprise sap 12 SP5
2.7.18-33.82.1
fixed
suse enterprise server 12 SP5
2.7.18-33.82.1
fixed
python-doc-pdf
suse enterprise sap 12 SP5
2.7.18-33.82.1
fixed
suse enterprise server 12 SP5
2.7.18-33.82.1
fixed
python-gdbm
suse enterprise sap 12 SP5
2.7.18-33.82.1
fixed
suse enterprise server 12 SP5
2.7.18-33.82.1
fixed
python-idle
suse enterprise sap 12 SP5
2.7.18-33.82.1
fixed
suse enterprise server 12 SP5
2.7.18-33.82.1
fixed
python-tk
suse enterprise sap 12 SP5
2.7.18-33.82.1
fixed
suse enterprise server 12 SP5
2.7.18-33.82.1
fixed
python-xml
suse enterprise sap 12 SP5
2.7.18-33.82.1
fixed
suse enterprise server 12 SP5
2.7.18-33.82.1
fixed
python3
suse enterprise sap 12 SP5
3.4.10-25.191.2
fixed
suse enterprise server 12 SP3
3.4.10-25.191.2
fixed
suse enterprise server 12 SP5
3.4.10-25.191.2
fixed
python3-base
suse enterprise sap 12 SP5
3.4.10-25.191.2
fixed
suse enterprise server 12 SP3
3.4.10-25.191.2
fixed
suse enterprise server 12 SP5
3.4.10-25.191.2
fixed
python3-curses
suse enterprise sap 12 SP5
3.4.10-25.191.2
fixed
suse enterprise server 12 SP3
3.4.10-25.191.2
fixed
suse enterprise server 12 SP5
3.4.10-25.191.2
fixed
python3-devel
suse enterprise sap 12 SP5
3.4.10-25.191.2
fixed
suse enterprise server 12 SP5
3.4.10-25.191.2
fixed
python3-tk
suse enterprise sap 12 SP5
3.4.10-25.191.2
fixed
suse enterprise server 12 SP5
3.4.10-25.191.2
fixed
python36
suse enterprise sap 12 SP5
3.6.15-116.1
fixed
suse enterprise server 12 SP3
3.6.15-6.159.1
fixed
suse enterprise server 12 SP5
3.6.15-116.1
fixed
python36-base
suse enterprise sap 12 SP5
3.6.15-116.1
fixed
suse enterprise server 12 SP3
3.6.15-6.159.1
fixed
suse enterprise server 12 SP5
3.6.15-116.1
fixed
python36-curses
suse enterprise server 12 SP3
3.6.15-6.159.1
fixed
python36-dbm
suse enterprise server 12 SP3
3.6.15-6.159.1
fixed
python36-devel
suse enterprise sap 12 SP5
3.6.15-116.1
fixed
suse enterprise server 12 SP3
3.6.15-6.159.1
fixed
suse enterprise server 12 SP5
3.6.15-116.1
fixed
python36-idle
suse enterprise server 12 SP3
3.6.15-6.159.1
fixed
python36-testsuite
suse enterprise server 12 SP3
3.6.15-6.159.1
fixed
python36-tk
suse enterprise server 12 SP3
3.6.15-6.159.1
fixed
python36-tools
suse enterprise server 12 SP3
3.6.15-6.159.1
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
python3.14-pip
RHEL 9
0:25.2-3.el9_8.5
fixed
python3.14-pip-wheel
RHEL 9
0:25.2-3.el9_8.5
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
python-pip-wheel
Amazon Linux 2
0:20.2.2-1.amzn2.0.18
fixed
python2-pip
Amazon Linux 2
0:20.2.2-1.amzn2.0.18
fixed
python3-pip
Amazon Linux 2
0:20.2.2-1.amzn2.0.18
fixed
Amazon Linux 2023
0:21.3.1-2.amzn2023.0.20
fixed
python3-pip-wheel
Amazon Linux 2023
0:21.3.1-2.amzn2023.0.20
fixed
python3.11-pip
Amazon Linux 2023
0:22.3.1-2.amzn2023.0.13
fixed
python3.11-pip-wheel
Amazon Linux 2023
0:22.3.1-2.amzn2023.0.13
fixed
python3.12-pip
Amazon Linux 2023
0:23.2.1-4.amzn2023.0.10
fixed
python3.12-pip-wheel
Amazon Linux 2023
0:23.2.1-4.amzn2023.0.10
fixed
python3.13-pip
Amazon Linux 2023
0:24.2-259.amzn2023.0.7
fixed
python3.13-pip-wheel
Amazon Linux 2023
0:24.2-259.amzn2023.0.7
fixed
python3.14-pip
Amazon Linux 2023
0:26.1.1-1.amzn2023.0.2
fixed
python3.14-pip-wheel
Amazon Linux 2023
0:26.1.1-1.amzn2023.0.2
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
python-pip
Azure Linux 3.0
0:24.2-9.azl3
fixed
python-virtualenv
Azure Linux 3.0
0:20.36.1-5.azl3
fixed
References