CVE-2026-3479
Path Traversal Vulnerability in Python pkgutil.get_data() Function
Publication date: 2026-03-18
Last updated on: 2026-04-07
Assigner: Python Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| python | cpython | to 3.15 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2026-3479 is a low severity vulnerability in Python's pkgutil.get_data() function. The issue arises because the function does not properly validate the resource argument as documented, which allows path traversal attacks."}, {'type': 'paragraph', 'content': 'This means an attacker could potentially manipulate the resource path to access files outside the intended resource directory, leading to unauthorized data access.'}] [1, 2, 3]
How can this vulnerability impact me? :
The vulnerability allows an attacker to perform path traversal by supplying crafted resource arguments to pkgutil.get_data(), potentially accessing files outside the intended scope.
This unauthorized access could expose sensitive data or system files that should not be accessible through the application using this function.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate CVE-2026-3479, you should update your Python installations to versions that include the security patch for pkgutil.get_data().
- Apply the patch merged on March 18, 2026, which enforces strict validation of the resource argument in pkgutil.get_data().
- Upgrade to Python versions 3.10, 3.11, 3.12, 3.13, 3.14 or later where the fix has been backported.
- Ensure that your environment does not use vulnerable versions of Python prior to the patch.