PT-2026-34538 · Pypi+1 · Poetry+1

Published 2026-04-22 · Updated 2026-05-26 · CVE-2026-41140

Positive Technologies (AI Summary)

CVSS v4.0

0.6

Low

Base vector

AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Poetry versions prior to 2.3.4

Description The extractall() function in src/poetry/utils/helpers.py extracts sdist tarballs without path traversal protection on Python versions where tarfile.data filter is unavailable. This occurs specifically on Python versions 3.10.0 through 3.10.12 and 3.11.0 through 3.11.4. An attacker can use a crafted sdist with ../../ tar member paths to perform arbitrary file writes outside the intended extraction directory. This can be achieved through direct path traversal, symlink traversal, or hardlink attacks. The issue is triggered during metadata resolution or when building a package from sdist.

Recommendations Update Poetry to version 2.3.4 or newer.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-41140

GHSA-73H3-MF4W-8647

Affected Products

Poetry

Red Os

References · 15

• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2026-41140 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-41140 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-41140 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-41140 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-41140 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-73h3-mf4w-8647 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-41140 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41140 · Security Note
• https://github.com/python-poetry/poetry · Note
• https://github.com/python-poetry/poetry/security/advisories/GHSA-73h3-mf4w-8647 · Note
• https://github.com/python-poetry/poetry/releases/tag/2.3.4 · Note
• https://t.me/cveNotify/161141 · Telegram Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-poetry-cve-2026-41140-8.0 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-poetry-cve-2026-41140-7.3 · Note
• https://twitter.com/CVEnew/status/2047731885963436138 · Twitter Post