CVE-2026-3479: pkgutil.get_data() does not enforce documented restrictions
DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.getdata() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if following the intended security model.
pkgutil.getdata() did not validate the resource argument as documented, allowing path traversals.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3479?
CVE-2026-3479 is classified as a medium severity vulnerability.
How do I fix CVE-2026-3479?
To fix CVE-2026-3479, update to the latest version of Python where the issue has been addressed.
What is the impact of CVE-2026-3479?
CVE-2026-3479 allows for path traversal attacks via the pkgutil.get_data() function.
Which versions of Python are affected by CVE-2026-3479?
CVE-2026-3479 affects specific versions of Python that allow the exploitation of the pkgutil.get_data() function.
Is CVE-2026-3479 being actively exploited in the wild?
As of now, there are no reports indicating that CVE-2026-3479 is being actively exploited in the wild.