# CVE-2026-115791: Prevent shadowing stdlib in gzip/tarfile/zipfile CLI during extraction

Status: published. Published: 2026-11-10. Updated: 2026-11-10.

When tarfile or zipfile command line interface (CLI) is used to

decompress an archive, a Python script shadowing the stdlib can be

created. Then if an error occurs during decompressing the next file,

the newly created Python script is executed. This is especially true

if the created Python is called traceback.py. The problem is that

Python adds the current directory to sys.path when python -m MODULE is

run, and the archive is also decompressed in the current directory.



The fix removes sys.path[0] in gzip, tarfile and zipfile command line

interface to prevent shadowing standard library modules from extracted

files.

## Remediation

- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: PSF) — https://github.com/python/cpython/pull/161706

## Affected products and versions

- Python Software Foundation / CPython: ≥ 0; < 3.16.0 (affected, python). Source: CNA: PSF

## Severity and prioritization

- CVSS 4.0: 5.3 (medium); CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N; source: CNA: PSF

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: exploitation none; automatable no; technical impact total; source ADP: CISA-ADP

- Weaknesses: CWE-829

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/python/cpython/issues/161705 (CNA: PSF; issue-tracking)

- https://github.com/python/cpython/pull/161706 (CNA: PSF; patch)

- https://mail.python.org/archives/list/security-announce@python.org/thread/ZKKA4Q7B35JEHSDIJNZ6TYKRDQJUHDAG/ (CNA: PSF; vendor-advisory)

## Provenance

- CNA: PSF: https://www.cve.org/CVERecord?id=CVE-2026-115791; retrieved 2026-11-10; source updated 2026-11-10

Revision: 1fd9f8abfd7b50cb970278d3ed2cb1637d977d59f718e624f553b10d7d577fbd

Canonical: https://y2.dev/cve/CVE-2026-115791

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.