CVE-2019-9948: Path Traversal
Last updated 25 August 2025
Other sources
urllib in Python 2.x through 2.7.16 supports the localfile: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('localfile:///etc/passwd') call.
Reference: https://bugs.python.org/issue35907 https://github.com/python/cpython/pull/11842
— Red Hat
Affected Software
Remediation
Information
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-9948?
CVE-2019-9948 is a vulnerability in urllib in Python 2.x through 2.7.16 that allows remote attackers to bypass protection mechanisms.
How severe is CVE-2019-9948?
CVE-2019-9948 has a severity rating of 9.1, which is considered critical.
Which software versions are affected by CVE-2019-9948?
Python 2.x through 2.7.16 is affected by CVE-2019-9948.
How can I fix CVE-2019-9948?
Upgrade to a version of Python that is not affected, such as Python 3.0 or later.
Where can I find more information about CVE-2019-9948?
You can find more information about CVE-2019-9948 in the references provided: https://bugs.python.org/issue35907, https://github.com/python/cpython/pull/11842, https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1695599