Bug 2547352

Summary: CVE-2026-12345 asahi-installer: python: Arbitrary file deletion via race condition during temporary directory cleanup [epel-all]
Product: [Fedora] Fedora EPEL Reporter: Srikanth Balasubramanian <sbalasub>
Component: asahi-installerAssignee: Davide Cavalca <davide>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: epel10CC: asahi-sig, davide
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["8b422260-3538-47b9-a268-0d2b59a7fbf4"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2543492    

Description Srikanth Balasubramanian 2026-10-07 09:53:38 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flags may still be reset outside of the tree on all platforms.