CVE-2026-115791: Prevent shadowing stdlib in gzip/tarfile/zipfile CLI during extraction

Published Nov 10, 2026

Updated

When tarfile or zipfile command line interface (CLI) is used to

decompress an archive, a Python script shadowing the stdlib can be

created. Then if an error occurs during decompressing the next file,

the newly created Python script is executed. This is especially true

if the created Python is called traceback.py. The problem is that

Python adds the current directory to sys.path when python -m MODULE is

run, and the archive is also decompressed in the current directory.

The fix removes sys.path[0] in gzip, tarfile and zipfile command line

interface to prevent shadowing standard library modules from extracted

files.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Configuration
Remove sys.path[0] when running the gzip, tarfile, and zipfile command-line interfaces to prevent extracted Python scripts from shadowing standard library modules.
Python gzip, tarfile, and zipfile command-line interfaces sys.path[0] = removed

Event History

Nov 10, 2026

CVE Published

via MITRE·04:33 PM

Data Sourced

via MITRE·04:33 PM

Description

Frequently Asked Questions

Who is exposed to this issue?

Users or automation that invoke the gzip, tarfile, or zipfile command-line interfaces to decompress archives in the current working directory are exposed. The issue depends on extracting archive contents that can create a Python file which shadows a standard-library module.

What does an attacker need to exploit it?

An attacker needs to supply a crafted archive containing a Python script with a standard-library module name, such as traceback.py. An error must then occur while decompressing a subsequent file, causing Python to import and execute the shadowing script.

Are normal library uses of gzip, tarfile, or zipfile affected?

The described issue applies to their command-line interfaces when run with python -m MODULE, because that invocation adds the current directory to sys.path. The provided information does not state that direct API use is affected.

What changes in the fix?

The fix removes sys.path[0] in the gzip, tarfile, and zipfile command-line interfaces. This prevents Python modules extracted into the current directory from shadowing standard-library modules during extraction.

CVE-2026-115791: Prevent shadowing stdlib in gzip/tarfile/zipfile CLI during extraction

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are normal library uses of gzip, tarfile, or zipfile affected?

What changes in the fix?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are normal library uses of gzip, tarfile, or zipfile affected?

What changes in the fix?