PT-2026-3918 · Pytest · Pytest

Published 2026-01-22 · Updated 2026-06-03 · CVE-2025-71176

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions pytest versions through 9.0.2

Description The software on UNIX systems creates directories using a predictable naming pattern, specifically '/tmp/pytest-of-{user}'. This design flaw allows local users to potentially disrupt service or escalate privileges.

Recommendations Update to a version of pytest later than 9.0.2.

Fix

DoS

LPE

Weakness Enumeration

CWE-379

Related Identifiers

AZL-75014

CVE-2025-71176

GHSA-6W46-J5RX-G56G

OPENSUSE-SU-2026:10666-1

OPENSUSE-SU-2026:20692-1

RHSA-2026:8580

SUSE-SU-2026:1744-1

SUSE-SU-2026:21568-1

Affected Products

Pytest

References · 21

• https://osv.dev/vulnerability/CVE-2025-71176 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-71176 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-71176 · Security Note
• https://ubuntu.com/security/CVE-2025-71176 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-71176 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10666-1 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2025-71176 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-71176 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-75014 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6w46-j5rx-g56g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-71176 · Security Note
• https://github.com/pytest-dev/pytest/issues/13669 · Note
• https://github.com/pytest-dev/pytest/pull/14343 · Note
• https://github.com/pytest-dev/pytest/commit/95d8423bd24992deea5b9df32555fa1741679e2c · Note
• https://github.com/pytest-dev/pytest/releases/tag/9.0.3 · Note