CVE-2026-3479 Details
Description
DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if following the intended security model. pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.
A path traversal vulnerability has been identified in the Python standard library's pkgutil module. The issue arises because the pkgutil.get_data() function does not properly validate the resource argument, as required by the documentation. This lack of validation allows for unauthorized access to file system paths, potentially leading to the exposure of sensitive data.
Users can update to the latest version of Python where this vulnerability has been addressed. Instructions for updating Python can be found in the official Python documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No CVSS 3.x data is available for this CVE.
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | CISA-ADP |
Affected Products
No affected product data is available for this CVE.
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Apr 7, 2026 | CVE Modified | [email protected] |
| Apr 7, 2026 | CVE Modified | [email protected] |
| Mar 19, 2026 | CVE Modified | [email protected] |
| Mar 18, 2026 | New CVE Received | [email protected] |
| Mar 18, 2026 | CVE Modified | CISA-ADP |