PT-2026-26139 · Pypi · Pkgutil

Stanfromireland · Published 2026-03-18 · Updated 2026-05-22 · CVE-2026-3479

Positive Technologies (AI Summary)

CVSS v4.0

Base vector

AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions pkgutil (affected versions not specified)

Description The pkgutil.get data() function did not properly validate the resource argument, as documented. This allowed for path traversal, potentially enabling unauthorized access to files.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BIT-LIBPYTHON-2026-3479

BIT-PYTHON-2026-3479

BIT-PYTHON-MIN-2026-3479

CVE-2026-3479

ECHO-C84E-DEA4-EC4C

OESA-2026-1899

OESA-2026-1900

OESA-2026-1901

OESA-2026-1902

OPENSUSE-SU-2026:10520-1

OPENSUSE-SU-2026:10521-1

OPENSUSE-SU-2026:10522-1

OPENSUSE-SU-2026:10552-1

OPENSUSE-SU-2026:10553-1

OPENSUSE-SU-2026:10554-1

OPENSUSE-SU-2026:10782-1

OPENSUSE-SU-2026:20517-1

PSF-2026-13

RHSA-2026:10118

RHSA-2026:11324

RHSA-2026:7443

RHSA-2026:7661

SUSE-SU-2026:1292-1

SUSE-SU-2026:1345-1

SUSE-SU-2026:1349-1

SUSE-SU-2026:1354-1

SUSE-SU-2026:1365-1

SUSE-SU-2026:1376-1

SUSE-SU-2026:1385-1

SUSE-SU-2026:1417-1

SUSE-SU-2026:1530-1

SUSE-SU-2026:1715-1

SUSE-SU-2026:1818-1

SUSE-SU-2026:21104-1

SUSE-SU-2026:21178-1

SUSE-SU-2026:21254-1

Affected Products

Pkgutil

References · 100

• https://github.com/python/cpython/pull/146122 · Patch
• https://github.com/python/cpython/commit/bcdf231946b1da8bdfbab4c05539bb0cc964a1c7 · Patch
• https://github.com/python/cpython/commit/cf59bf76470f3d75ad47d80ffb8ce76b64b5e943 · Patch
• https://github.com/python/cpython/commit/5af6ce3e7b643a30a02d22245c1e3f4a8bc0a1fe · Patch
• https://github.com/python/cpython/commit/d786d59a8f7196bb630100a869f28ad13436b59c · Patch
• https://mail.python.org/archives/list/[e-mail]/thread/WYLLVQOOCKGK73JM7Z7ZSNOJC4N7BAWY · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1365-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-3479 · Vendor Advisory
• https://osv.dev/vulnerability/PSF-2026-13 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1899 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10520-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-3479 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10552-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1900 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10554-1 · Vendor Advisory