Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory
The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flags may still be reset outside of the tree on all platforms.
CVE-2026-12345
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-12345
CPython
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/python/cpython",
"vendor": "Python Software Foundation",
"modules": [
"tempfile"
],
"product": "CPython",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "3.12.15",
"versionType": "python"
},
{
"status": "affected",
"version": "3.14.0",
"lessThan": "3.14.9",
"versionType": "python"
},
{
"status": "affected",
"version": "3.15.0a1",
"lessThan": "3.15.0rc3",
"versionType": "python"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-12345
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #50035 · Revision 1
- Added to Heist Feed
- Publisher date