Description
The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flags may still be reset outside of the tree on all platforms.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Python Software Foundation | CPython | < 3.12.15, 3.13.0 – < 3.13.18, 3.14.0 – < 3.14.9, 3.15.0a1 – < 3.15.0rc3 | 3.12.15 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pypy3 | No fix yet | — |
| Debian 14 | python3.14 | 3.14.9-1 | — |
| Debian 14 | python3.15 | 3.15.0~rc3-1 | — |
| Debian 13 | pypy3 +1 | No fix yet | — |
| Debian 12 | pypy3 +1 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | python3.14 | No fix yet | — |
| Ubuntu 26.04 LTS | python3.14 | No fix yet | — |
| Ubuntu 24.04 LTS | python3.12 | No fix yet | — |
| Ubuntu 22.04 LTS | python3.10 | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | python2.7 +1 | No fix yet | — |
| Ubuntu Pro 20.04 LTS | python2.7 +2 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | python2.7 +3 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | python2.7 +1 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | python2.7 +2 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | python3 +8 | 3.12.16-2.el10_3 | RHSA-2026:98615 |
| RHEL 9 | python3 +8 | 3.9.25-7.el9_8.6 | RHSA-2026:98511, RHSA-2026:89742 |
| RHEL 8 | python3 +7 | 3.6.8-79.el8_10 | RHSA-2026:85239 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | python3 +15 | 3.14.8-1.hum1 | RHSA-2026:74870 |
| Red Hat Hardened Images 1 | python3.12 +6 | 3.12.15-1.hum1 | RHSA-2026:74922 |
| Red Hat Hardened Images 1 | python3.13 +8 | 3.13.16-1.hum1 | RHSA-2026:75119 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | python3 +7 | 3.9.25-7.el9_8.6 | ALSA-2026:89742 |
| AlmaLinux 8 | python3-idle +6 | 3.6.8-79.el8_10.alma.1 | ALSA-2026:85239 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | python3 +7 | 3.12.16-2.el10_3 | RLSA-2026:98615 |
| Rocky Linux 9 | python3.9 | 3.9.25-7.el9_8.6 | RLSA-2026:89742 |
| Rocky Linux 8 | python3 | 3.6.8-79.el8_10.rocky.0 | RLSA-2026:85239 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python315 | 3.15.0-1.1 | openSUSE-SU-2026:12125-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | python3 | 3.14.10-r0 | — |
| Alpine v3.23 | python3 | 3.12.16-r0 | — |
| Alpine v3.22 | python3 | 3.12.16-r0 | — |
| Alpine v3.21 | python3 | 3.12.16-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | python3.12 +6 | 3.12.16-2.amzn2023.0.1 | ALAS2023-2026-3408 |
| Amazon Linux 2023 | python3.13 +8 | 3.13.18-1.amzn2023.0.1 | ALAS2023-2026-3407 |
| Amazon Linux 2023 | python3.14 +13 | 3.14.10-1.amzn2023.0.1 | ALAS2023-2026-3406 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python3 | 3.12.16-1 | — |
| Azure Linux 3 | tensorflow | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | python3 +7 | 3.9.25-7.0.1.el9_8.6 | ELSA-2026-89742 |
| Oracle Linux 8 | python3-idle +6 | 3.6.8-79.0.1.el8_10 | ELSA-2026-85239 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | python-3.10 +1 | No fix yet | — |
| Wolfi rolling | python-3.12 | 3.12.16-r0 | — |
| Wolfi rolling | python-3.13 | 3.13.18_git20261030-r0 | — |
| Wolfi rolling | python-3.14 | 3.14.8_git20261014-r0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
zahidec0de/CVE-2026-12345-poc ★ 0 · Aug 14, 2026
Proof of Concept (PoC) for CVE-2026-64638, a reflected XSS in WordPress Core < 7.0.3.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 19
- RHSA-2026:98511 Red Hat Security Advisory: python3.9 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:98615 Red Hat Security Advisory: python3.12 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:89742 Red Hat Security Advisory: python3.9 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RLSA-2026:98615 Moderate: python3.12 security, bug fix, and enhancement update Rocky Linux Security Advisories · Nov 13, 2026
- WID-SEC-2026-3656 CPython: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen und Manipulation von Dateien BSI CERT-Bund (WID) · Nov 12, 2026
- ALAS2023-2026-3406 Moderate: python3.14 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 9, 2026
- ALAS2023-2026-3407 Moderate: python3.13 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 9, 2026
- ALAS2023-2026-3408 Moderate: python3.12 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 9, 2026
- ALSA-2026:89742 Important: python3.9 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:85239 Important: python3 security update AlmaLinux Security Advisories · Oct 29, 2026
- RLSA-2026:89742 Important: python3.9 security update Rocky Linux Security Advisories · Oct 27, 2026
- ELSA-2026-89742 Important: python3.9 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 26, 2026
- RLSA-2026:85239 Important: python3 security update Rocky Linux Security Advisories · Oct 21, 2026
- RHSA-2026:85239 Red Hat Security Advisory: python3 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:75119 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:74870 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:74922 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- ELSA-2026-85239 Important: python3 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 20, 2026
- openSUSE-SU-2026:12125-1 python315-3.15.0-1.1 on GA media SUSE / openSUSE Security Updates · Oct 14, 2026
References
- https://github.com/python/cpython/pull/157580 patch
- https://github.com/python/cpython/issues/157579 issue-tracking
- https://github.com/python/cpython/commit/5c20517a4fc56683efe63a7751020db9573f538d patch
- https://github.com/python/cpython/commit/458e7134a5af7f86aee9d21b51cf499b41aa4420 patch
- https://github.com/python/cpython/commit/e1f3590f155c6d66007e958c98c9d69316551993 patch
- https://github.com/python/cpython/commit/06ef3d43fdaf4da97af12fa694b4886092c4b970 patch
- https://github.com/python/cpython/commit/58ed0259cae509a19138795df302fe60b544dc74 patch
- https://github.com/python/cpython/commit/0478b52788117db4b831b3efd648f56b777628aa patch
- https://github.com/python/cpython/commit/c39b52d00b42200aaadff679e2fe3f1006d57c58 patch