CVE-2026-3479
Unknown
Description
DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if following the intended security model. pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.
SeverityUnknown
CVSS0.0
Exploit probability—
ProductCPython
PublishedMar 18, 2026
First seenMar 18, 2026
Weakness typeCWE-22Path traversal
How to fix
Update
- Python Software Foundation CPython3.13.13, 3.14.4, 3.15.0a8 or later
Patches
- github.com/python/cpython/pull/146122
- github.com/python/cpython/commit/bcdf231946b1da8bdfbab4c05539bb0cc964a1c7
- github.com/python/cpython/commit/5af6ce3e7b643a30a02d22245c1e3f4a8bc0a1fe
- github.com/python/cpython/commit/cf59bf76470f3d75ad47d80ffb8ce76b64b5e943
- github.com/python/cpython/commit/d786d59a8f7196bb630100a869f28ad13436b59c
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Python Software Foundation CPython | v < 3.13.13, 3.14.0 ≤ v < 3.14.4, 3.15.0a1 ≤ v < 3.15.0a8 | 3.13.13, 3.14.4, 3.15.0a8 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.