PT-2026-5679 · Pypi+1 · Pip+1

Notatallshaw · Published 2026-01-01 · Updated 2026-04-17 · CVE-2026-1703

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions pip (affected versions not specified)

Description A crafted wheel archive during installation and extraction by pip may allow files to be extracted outside the intended installation directory. This path traversal is limited to prefixes of the installation directory, restricting the ability to overwrite executable files in common scenarios.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

AZL-76496

AZL-76499

AZL-76593

AZL-76599

AZL-77910

BDU:2026-01708

BIT-PIP-2026-1703

CVE-2026-1703

ECHO-7DB2-03AA-5591

GHSA-6VGW-5PG2-W6JP

OESA-2026-1443

OESA-2026-1444

OESA-2026-1446

OESA-2026-1447

OESA-2026-1448

OPENSUSE-SU-2026:10210-1

OPENSUSE-SU-2026:20202-1

RHSA-2026:7610

SUSE-SU-2026:0420-1

SUSE-SU-2026:0805-1

SUSE-SU-2026:20423-1

Affected Products

Red Os

Pip

References · 50

• https://github.com/pypa/pip/commit/8e227a9be4faa9594e05d02ca05a413a2a4e7735 · Patch
• https://github.com/pypa/pip/pull/13777 · Patch
• https://osv.dev/vulnerability/OESA-2026-1444 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1443 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20423-1 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-pip-2026-1703 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-76496 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-01708 · Security Note
• https://osv.dev/vulnerability/AZL-76599 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0805-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1448 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-76593 · Vendor Advisory
• https://mail.python.org/archives/list/[e-mail]/thread/WIEA34D4TABF2UNQJAOMXKCICSPBE2DJ · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20202-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-1703 · Vendor Advisory