UBUNTU-CVE-2026-115791: Medium severity ubuntu/python2.7 vulnerability
When tarfile or zipfile command line interface (CLI) is used to decompress an archive, a Python script shadowing the stdlib can be created. Then if an error occurs during decompressing the next file, the newly created Python script is executed. This is especially true if the created Python is called traceback.py. The problem is that Python adds the current directory to sys.path when python -m MODULE is run, and the archive is also decompressed in the current directory. The fix removes sys.path[0] in gzip, tarfile and zipfile command line interface to prevent shadowing standard library modules from extracted files.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users or automated processes that use the tarfile, zipfile, or gzip Python command-line interfaces to decompress archives in their current working directory are exposed. The listed affected Ubuntu packages include python2.7 and Python 3.4 through 3.9, as well as python3.14.
What does an attacker need to exploit it?
An attacker needs to supply an archive containing a Python file that shadows a standard-library module, such as traceback.py. An error must then occur while decompressing a subsequent file, causing Python to import and execute the extracted shadowing file.
Are normal archive extraction workflows affected?
The issue specifically concerns the Python tarfile, zipfile, and gzip command-line interfaces, where extraction occurs in the current directory and Python is invoked with python -m MODULE. The supplied data does not establish impact for other archive extraction tools or library API use.
What changes in the fix?
The fix removes sys.path[0] from the gzip, tarfile, and zipfile command-line interfaces. This prevents files extracted into the current directory from shadowing standard-library modules during error handling.