PT-2026-49724 · Python+1 · Cpython

Jake Yamaki + 1 · Published 2026-06-16 · Updated 2026-06-17 · CVE-2026-12003

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Python (affected versions not specified)

Description On Windows, Python uses the VPATH variable to locate landmarks, such as 'Modules/setup.local', to determine if it is running in a source tree and adjust the default sys.path. In certain configurations, specifically with the legacy EXE installer, the VPATH value '....' results in a landmark path outside the installation directory. Because Windows may allow low-privilege users to create folders in the root directory of the OS drive, an attacker could create the landmark and an alternative Lib folder. This allows the restricted installation to discover and load unauthorized files, potentially leading to a privilege escalation.

Recommendations Migrate from the legacy installer to the Python install manager to perform a per-user installation. Preemptively create and restrict access to a Modules directory.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2026-12003

PSF-2026-28

Affected Products

Cpython

References · 9

• https://github.com/python/cpython/pull/151545 · Patch
• https://osv.dev/vulnerability/PSF-2026-28 · Vendor Advisory
• https://https//mail.python.org/archives/list/[e-mail]/thread/JIFOBO7UX3LY4VJKJUOKYJV62CFR2IRH · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-12003 · Security Note
• https://github.com/python/cpython/issues/151544 · Note
• https://twitter.com/canartuc/status/2067296841700344151 · Twitter Post
• http://openwall.com/lists/oss-security/2026/06/16/8 · Note
• https://twitter.com/canartuc/status/2067285014123819169 · Twitter Post
• https://twitter.com/CVEnew/status/2066980898965540938 · Twitter Post