Bug 2569866 (CVE-2026-115791) - CVE-2026-115791 python: Python: Arbitrary code execution via standard library module shadowing during archive extraction
Summary: CVE-2026-115791 python: Python: Arbitrary code execution via standard library...
Keywords:
Status: NEW
Alias: CVE-2026-115791
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-11-10 19:20 UTC by OSIDB Bzimport
Modified: 2026-11-10 19:42 UTC (History)
22 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-11-10 19:20:25 UTC
When tarfile or zipfile command line interface (CLI) is used to

decompress an archive, a Python script shadowing the stdlib can be

created. Then if an error occurs during decompressing the next file,

the newly created Python script is executed. This is especially true

if the created Python is called traceback.py. The problem is that

Python adds the current directory to sys.path when python -m MODULE is

run, and the archive is also decompressed in the current directory.



The fix removes sys.path[0] in gzip, tarfile and zipfile command line

interface to prevent shadowing standard library modules from extracted

files.


Note You need to log in before you can comment on or make changes to this bug.