REDHAT-BUG-2461604: Path Traversal

Q: What is the severity of REDHAT-BUG-2461604?

The severity of REDHAT-BUG-2461604 is classified as high with a score of 7.

Q: What is the risk associated with REDHAT-BUG-2461604?

The risk associated with REDHAT-BUG-2461604 is rated at 33.

Q: How do I fix REDHAT-BUG-2461604?

To fix REDHAT-BUG-2461604, upgrade to Poetry version 2.3.4 or higher, which includes the necessary path traversal protections.

Q: Which software versions are affected by REDHAT-BUG-2461604?

REDHAT-BUG-2461604 affects versions of Poetry prior to 2.3.4.

Q: What type of vulnerability is REDHAT-BUG-2461604 classified as?

REDHAT-BUG-2461604 is classified as a Path Traversal vulnerability.

Published Apr 24, 2026

Updated

Poetry is a dependency manager for Python. Prior to 2.3.4, the extractall() function in src/poetry/utils/helpers.py:410-426 extracts sdist tarballs without path traversal protection on Python versions where tarfile.datafilter is unavailable. Considering only Python versions which are still supported by Poetry, these are 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4. This vulnerability is fixed in 2.3.4.

Affected Software

2 affected components

pypi/poetry<2.3.4

Python Python>=3.10.0<=3.10.12, >=3.11.0<=3.11.4

Event History

Apr 24, 2026

Data Sourced

via Red Hat·06:01 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2461604?

The severity of REDHAT-BUG-2461604 is classified as high with a score of 7.

What is the risk associated with REDHAT-BUG-2461604?

The risk associated with REDHAT-BUG-2461604 is rated at 33.

How do I fix REDHAT-BUG-2461604?

To fix REDHAT-BUG-2461604, upgrade to Poetry version 2.3.4 or higher, which includes the necessary path traversal protections.

Which software versions are affected by REDHAT-BUG-2461604?

REDHAT-BUG-2461604 affects versions of Poetry prior to 2.3.4.

What type of vulnerability is REDHAT-BUG-2461604 classified as?

REDHAT-BUG-2461604 is classified as a Path Traversal vulnerability.