REDHAT-BUG-2543492: Race Condition

Published Sep 29, 2026

Updated

The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoidssymlinkattacks is false, remain affected, and file flags may still be reset outside of the tree on all platforms.

Affected Software

1 affected component

Python Software Foundation Python

Event History

Sep 29, 2026

Data Sourced

via Red Hat·06:37 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is realistically exposed to this issue?

Processes that use tempfile.TemporaryDirectory and run cleanup with privileges that could affect files outside the temporary directory are exposed if an attacker can modify the temporary-directory tree during cleanup.

What must an attacker be able to do to exploit it?

The attacker must be able to modify the directory tree while cleanup is in progress. They can replace a directory with a symbolic link, potentially causing deletion of external files or resetting their permissions or file flags using the cleanup process's privileges.

Are all platforms affected in the same way?

No. Platforms where shutil.rmtree.avoids_symlink_attacks is false remain affected by the symlink attack. File flags may still be reset outside the temporary-directory tree on all platforms.

REDHAT-BUG-2543492: Race Condition

Affected Software

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What must an attacker be able to do to exploit it?

Are all platforms affected in the same way?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What must an attacker be able to do to exploit it?

Are all platforms affected in the same way?