Bug 2569866 (CVE-2026-115791)

Summary: CVE-2026-115791 python: Python: Arbitrary code execution via standard library module shadowing during archive extraction
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: bbrownin, cahl, dfreiber, dkeler, drow, gbenhaim, jburrell, jlanda, kshier, ljawale, msilmser, niyer, rbobbitt, rhel-process-autobot, simaishi, stcannon, suppawar, thason, twaugh, vkumar, watson-tool-maintainers, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Python. This vulnerability can lead to arbitrary code execution when an archive is extracted using built-in command-line tools such as tarfile or zipfile. Because the current working directory is included in Python's module search path, an archive containing a script named after a standard library module can shadow trusted code. If an error occurs during decompression, the interpreter inadvertently loads and executes the attacker-controlled script with the privileges of the running user.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-10 19:20:25 UTC 
When tarfile or zipfile command line interface (CLI) is used to

decompress an archive, a Python script shadowing the stdlib can be

created. Then if an error occurs during decompressing the next file,

the newly created Python script is executed. This is especially true

if the created Python is called traceback.py. The problem is that

Python adds the current directory to sys.path when python -m MODULE is

run, and the archive is also decompressed in the current directory.



The fix removes sys.path[0] in gzip, tarfile and zipfile command line

interface to prevent shadowing standard library modules from extracted

files.