Race Condition in tempfile.TemporaryDirectory Cleanup (3.14.9)
CVE-2026-12345 Published on September 29, 2026
Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory
The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flags may still be reset outside of the tree on all platforms.
Vulnerability Analysis
CVE-2026-12345 can be exploited with local system access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is an insecure temporary file Vulnerability?
The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CVE-2026-12345 has been classified to as an insecure temporary file vulnerability or weakness.
Products Associated with CVE-2026-12345
Want to know whenever a new CVE is published for Cpython? stack.watch will email you.
Affected Versions
Python Software Foundation CPython:- Before 3.12.15 is affected.
- Version 3.15.0a1 and below 3.15.0rc3 is affected.