Critical Path Traversal Vulnerability in python3.14-pip Package
Summary
RLSA-2026:36193: Important: python3.14-pip security update. Affects python3.14-pip versions < 0:25.2-3.el10_2.5. Fixed in 0:25.2-3.el10_2.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The python3.14-pip package is a package management system for Python, allowing users to install and manage additional libraries and dependencies that are not part of the standard library. It is widely used in various applications for its ease of use and extensive library support. However, a critical vulnerability has been identified that allows for path traversal, which can lead to arbitrary file overwrites, posing significant security risks.
Vulnerability Detail
The vulnerability, identified as CVE-2026-8643, originates from a flaw in the pip wheel installation process. Specifically, it allows an attacker to exploit a malicious entry point name, enabling them to overwrite arbitrary files on the system. This could lead to unauthorized access, data corruption, or even complete system compromise, depending on the files targeted. The CVSS score for this vulnerability is 8.0, indicating a high level of severity.
How To Fix
Minimum fixed version
0:25.2-3.el10_2.5
This is the first release that contains the fix.
sudo dnf update python3.14-pipTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict the use of pip to trusted sources and avoid installing packages from unverified repositories until the update is applied. Additionally, consider implementing file system permissions that limit write access to sensitive directories.
Conclusion
The python3.14-pip package has a critical vulnerability (CVE-2026-8643) that allows for path traversal and arbitrary file overwrites. It is crucial to update to the patched version to mitigate risks. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for python3.14-pip →
FAQ
CVE-2026-8643 is a critical vulnerability in the python3.14-pip package that allows for path traversal, enabling arbitrary file overwrites.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to unauthorized access, data corruption, or complete system compromise, depending on the files that are overwritten.
Yes, a patched version of python3.14-pip is available. You can update to the fixed version using 'sudo yum update python3.14-pip'.
If you cannot update immediately, restrict pip usage to trusted sources and implement file system permissions to limit write access to sensitive directories.
Related vulnerabilities
Recent vulnerabilities recorded for python3.14-pip.
