CVE-2026-12345

— UNSCOREDpublic exploit available

Published 2026-09-29 · Updated 2026-09-29

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flags may still be reset outside of the tree on all platforms.

Weaknesses

CWE-59

Public exploit & PoC references

https://github.com/python/cpython/commit/5c20517a4fc56683efe63a7751020db9573f538d
https://github.com/python/cpython/issues/157579
https://github.com/python/cpython/pull/157580

All references

https://github.com/python/cpython/commit/5c20517a4fc56683efe63a7751020db9573f538d
https://github.com/python/cpython/issues/157579
https://github.com/python/cpython/pull/157580
http://www.openwall.com/lists/oss-security/2026/09/29/40

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2026-100419PoC
HIGHCVE-2026-100690PoC
HIGHCVE-2026-100692PoC
CRITICALCVE-2026-100715PoC
CRITICALCVE-2026-100716PoC
HIGHCVE-2026-100838PoC
CRITICALCVE-2026-101894PoC
UNSCOREDCVE-2026-102242PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.