Critical Security Flaw in Python3 Packages: Directory Escape Vulnerability

platform-python Updated 19 Aug 2026

Summary

18/08/2026

Disclosed on

N/A

Severity

Yes i

Fix available

Unrated

Severity

Not published

CVSS Score

ALSA-2026:56219: Important: python3 security update. Affects platform-python versions < 3.6.8-78.el8_10.alma.1. Fixed in 3.6.8-78.el8_10.alma.1. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Python is a widely-used interpreted programming language known for its versatility and ease of use. It supports various programming paradigms and is equipped with extensive libraries and frameworks. The affected packages, including platform-python, python3-libs, and others, are integral to the Python 3 ecosystem on AlmaLinux 8, providing essential functionalities for development and execution of Python applications. The vulnerability in question allows for a security breach through improper handling of tarfile extraction, posing a risk to the integrity of the system.

Vulnerability Detail

The vulnerability identified as CVE-2026-11940 is a directory escape flaw in the tarfile extraction process of Python's CPython implementation. This flaw allows attackers to manipulate the extraction path, potentially leading to unauthorized file access or overwriting critical system files. The issue arises from insufficient validation of file paths during the extraction process, which can be exploited to escape the intended directory structure. If successfully exploited, this vulnerability could compromise the security of the entire system, leading to data loss or unauthorized access.

How To Fix

Minimum fixed version

3.6.8-78.el8_10.alma.1

This is the first release that contains the fix.

sudo dnf update platform-python

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

As a temporary measure, it is advisable to avoid using the tarfile module for untrusted archives until the packages are updated. If you must extract tar files, ensure that they are from trusted sources and validate the paths before extraction.

Conclusion

The directory escape vulnerability in Python's tarfile extraction process poses a significant risk to systems using the affected packages on AlmaLinux 8. It is crucial to update to the patched version to mitigate potential security threats. Regular monitoring and updates are essential for maintaining system integrity.

See every vulnerability recorded for platform-python →