CVE-2026-1703: pip Path Traversal Vulnerability in Package Installation
Summary
CVE-2026-1703: pip Path Traversal vulnerability. Affects pip versions < 26.0. Fixed in 26.0. How to fix ↓
Also tracked for
The same CVE-2026-1703 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pip is a widely used package management system for Python, allowing users to install and manage software packages written in Python. It simplifies the process of package installation, dependency management, and version control. However, pip has been found to have a path traversal vulnerability that can potentially compromise the integrity of the installation process.
Vulnerability Detail
The vulnerability arises when pip installs and extracts a maliciously crafted wheel archive, leading to files being extracted outside the intended installation directory. This path traversal is limited to prefixes of the installation directory, which means it typically cannot inject or overwrite executable files in most scenarios. However, it still poses a risk as it could lead to unauthorized file access or manipulation within the system.
How To Fix
Latest published version: 26.2.2 as of 22 Oct 2026
pip install --upgrade "pip==26.2.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
26.0
This is the first release that contains the fix.
pip install --upgrade "pip==26.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid installing untrusted wheel archives or ensure that they only install packages from verified sources. Additionally, using virtual environments can help isolate installations and mitigate potential risks.
Conclusion
The pip path traversal vulnerability (CVE-2026-1703) poses a risk during the installation of malicious wheel archives. Users are advised to update to the latest version of pip to ensure protection against this vulnerability. Employing best practices such as using trusted sources and virtual environments can further enhance security.
See every vulnerability recorded for pip →
FAQ
CVE-2026-1703 is a vulnerability in pip that allows for path traversal during the installation of maliciously crafted wheel archives.
This vulnerability can lead to unauthorized file extraction outside the intended installation directory, potentially compromising system integrity.
You should update pip to version 26.0 or later to mitigate the vulnerability.
Yes, you can use Vulert's playground at Vulert Scanner to check for vulnerabilities in your application without needing to sign up.
Vulert is a tool that monitors and alerts users in real-time for open-source vulnerabilities in software, using just the Pipfile.lock for analysis.
References
Related vulnerabilities
Recent vulnerabilities recorded for pip.
