Path traversal in pip - CVE-2026-8643

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU158572

Path traversal in pip - CVE-2026-8643

Published: October 30, 2026


Vulnerability identifier: #VU158572
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-8643
CWE-ID: CWE-22
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.


Affected software

pip
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
openEuler
Anolis OS
Fedora
python-pip
python-pip-help
python-pip-wheel
python2-pip
python3-pip
python3.14-pip (Red Hat package)
mingw-python-pip
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data

How to mitigate CVE-2026-8643

Install updates from vendor's website.

pip - update to 26.1.2
python-pip - addressed in versions 20.2.2-20, 21.3.1-19, 23.3.1-13
python-pip-help - addressed in versions 20.2.2-20, 21.3.1-19, 23.3.1-13
python-pip-wheel - addressed in versions 20.2.2-20, 21.3.1-19, 23.3.1-13
python2-pip - update to 20.2.2-20
python3-pip - addressed in versions 20.2.2-20, 21.3.1-19, 23.3.1-13
python3-pip - update to 23.3.1-9
python-pip-wheel - update to 23.3.1-9
python3.14-pip (Red Hat package) - addressed in versions 25.2-3.el9_8.5, 25.2-3.el10_2.5
mingw-python-pip - addressed in versions 26.1.2-1.fc43, 26.1.2-1.fc44
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.4.0 Patch 8

External References

Related Security Bulletins