Skip to content
OpenAdvisories
Medium · 5.3 CVE-2026-115791 EUVD-2026-121328GHSA-mcvr-4p4q-h9hh

Prevent shadowing stdlib in gzip/tarfile/zipfile CLI during extraction

Published Nov 10, 2026 · Updated Nov 11, 2026 · Assigned by PSF

Description

When tarfile or zipfile command line interface (CLI) is used to

decompress an archive, a Python script shadowing the stdlib can be

created. Then if an error occurs during decompressing the next file,

the newly created Python script is executed. This is especially true

if the created Python is called traceback.py. The problem is that

Python adds the current directory to sys.path when python -m MODULE is

run, and the archive is also decompressed in the current directory.

The fix removes sys.path[0] in gzip, tarfile and zipfile command line

interface to prevent shadowing standard library modules from extracted

files.

Affected products

VendorProductAffectedFixed
Python Software Foundation CPython < 3.16.0 3.16.0

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Ubuntu 26.10 python3.14 No fix yet —
Ubuntu 26.04 LTS python3.14 No fix yet —
Ubuntu 24.04 LTS python3.12 No fix yet —
Ubuntu 22.04 LTS python3.10 No fix yet —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS python2.7 +1 No fix yet —
Ubuntu Pro 20.04 LTS python2.7 +2 No fix yet —
Ubuntu Pro 18.04 LTS python2.7 +3 No fix yet —
Ubuntu Pro 16.04 LTS python2.7 +1 No fix yet —
Ubuntu Pro 14.04 LTS python2.7 +2 No fix yet —

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 python3 +2 No fix yet —

Advisories 1

References