CVE-2026-12345
Medium
Description
The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flags may still be reset outside of the tree on all platforms.
SeverityMedium
CVSS5.9
Exploit probability—
Product
Microsoft Azl3 Python3 3.12.14-2
PublishedSep 29, 2026
First seenSep 29, 2026
Weakness typeCWE-59Improper link resolution
How to fix
Patches
- github.com/python/cpython/pull/157580
- github.com/python/cpython/commit/5c20517a4fc56683efe63a7751020db9573f538d
- github.com/python/cpython/commit/458e7134a5af7f86aee9d21b51cf499b41aa4420
- github.com/python/cpython/commit/e1f3590f155c6d66007e958c98c9d69316551993
- github.com/python/cpython/commit/06ef3d43fdaf4da97af12fa694b4886092c4b970
- github.com/python/cpython/commit/58ed0259cae509a19138795df302fe60b544dc74
- github.com/python/cpython/commit/0478b52788117db4b831b3efd648f56b777628aa
- github.com/python/cpython/commit/c39b52d00b42200aaadff679e2fe3f1006d57c58
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| microsoft azl3_python3_3.12.14-2 | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.