GitHub Advisoryadvisory · PyPI

GHSA-6vgw-5pg2-w6jp pip Path Traversal vulnerability

LOW Published 2026-02-02 Modified 2026-02-02 Official page ↗
Aliases
CVE-2026-1703
Ecosystem
PyPI
Packages
pip
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-22
Reviewed
2026-02-02

Affected packages

• PyPI pip: < 26.0 → fixed in 26.0

Description

When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations.

Related

Alias · CVE (1)

  • CVE-2026-1703 When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References