{"affected":[{"defaultStatus":"unaffected","product":"CPython","source":"CNA: PSF","vendor":"Python Software Foundation","versions":[{"lessThan":"3.16.0","status":"affected","version":"0","versionType":"python"}]}],"cveId":"CVE-2026-115791","cwes":["CWE-829"],"description":"When tarfile or zipfile command line interface (CLI) is used to\n\ndecompress an archive, a Python script shadowing the stdlib can be\n\ncreated. Then if an error occurs during decompressing the next file,\n\nthe newly created Python script is executed. This is especially true\n\nif the created Python is called traceback.py. The problem is that\n\nPython adds the current directory to sys.path when python -m MODULE is\n\nrun, and the archive is also decompressed in the current directory.\n\n\n\nThe fix removes sys.path[0] in gzip, tarfile and zipfile command line\n\ninterface to prevent shadowing standard library modules from extracted\n\nfiles.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: PSF","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1794331502503,"publishedAt":1794328429360,"references":[{"source":"CNA: PSF","tags":["issue-tracking"],"url":"https://github.com/python/cpython/issues/161705"},{"source":"CNA: PSF","tags":["patch"],"url":"https://github.com/python/cpython/pull/161706"},{"source":"CNA: PSF","tags":["vendor-advisory"],"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/ZKKA4Q7B35JEHSDIJNZ6TYKRDQJUHDAG/"}],"remediation":[{"kind":"fix","source":"CNA: PSF","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/python/cpython/pull/161706"}],"revision":"1fd9f8abfd7b50cb970278d3ed2cb1637d977d59f718e624f553b10d7d577fbd","sources":[{"modifiedAt":1794331502503,"name":"CNA: PSF","retrievedAt":1794334142112,"url":"https://www.cve.org/CVERecord?id=CVE-2026-115791"}],"ssvc":{"assessedAt":1794331499223,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Prevent shadowing stdlib in gzip/tarfile/zipfile CLI during extraction","updatedAt":1794334142112}