CVE-2014-1858: Vulnerability in NumPy Allows Arbitrary File Write
Summary
CVE-2014-1858: init.py in f2py in NumPy before 1.8.1 allows local users to write to arbitrary files via a symlink attack on a temporary file. Affects numpy across 2 version ranges.
< 0bb46c1448b0d3f5453d5182a17ea7ac5854ee15
< 1.8.1
Fixed in 0bb46c1448b0d3f5453d5182a17ea7ac5854ee15. How to fix ↓
Also tracked for
- python-numpy · Debian:10
The same CVE-2014-1858 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NumPy is a popular Python package that provides support for large, multi-dimensional arrays and matrices, along with a collection of mathematical functions to operate on these arrays. It is widely used in scientific computing and data analysis applications. However, prior to version 1.8.1, NumPy was susceptible to a vulnerability that allowed local users to write to arbitrary files through a symlink attack on a temporary file.
Vulnerability Detail
The vulnerability (CVE-2014-1858) in NumPy stemmed from the init.py file in the f2py module. By exploiting a symlink attack on a temporary file, local users could gain unauthorized write access to arbitrary files. This could lead to various security risks, such as unauthorized modification or deletion of critical files, privilege escalation, or the execution of arbitrary code.
How To Fix
Latest published version: 2.5.4 as of 23 Oct 2026
pip install --upgrade "numpy==2.5.4"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0bb46c1448b0d3f5453d5182a17ea7ac5854ee15
This is the first release that contains the fix.
pip install --upgrade "numpy==0bb46c1448b0d3f5453d5182a17ea7ac5854ee15"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of NumPy is not immediately feasible, users can implement a workaround by ensuring that the temporary files used by NumPy are not susceptible to symlink attacks. This can be achieved by setting appropriate file permissions and ensuring that the temporary files are created in a secure directory that is not accessible to untrusted users.
Conclusion
In conclusion, the vulnerability (CVE-2014-1858) in NumPy allowed local users to write to arbitrary files through a symlink attack on a temporary file. To mitigate this vulnerability, it is crucial to upgrade to NumPy version 1.8.1 or later. Alternatively, users can implement a workaround by securing the temporary files used by NumPy. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for numpy →
FAQ
NumPy is a Python package that provides support for large, multi-dimensional arrays and matrices, along with a collection of mathematical functions to operate on these arrays. It is widely used in scientific computing and data analysis applications.
The vulnerability allows local users to write to arbitrary files, which can lead to unauthorized modification or deletion of critical files, privilege escalation, or the execution of arbitrary code.
To fix this vulnerability, it is recommended to upgrade to NumPy version 1.8.1 or later. Alternatively, you can implement a workaround by securing the temporary files used by NumPy.
Yes, if upgrading to the latest version of NumPy is not immediately feasible, you can secure the temporary files used by NumPy by setting appropriate file permissions and ensuring they are created in a secure directory.
You can find more information about this vulnerability in the official NumPy advisory database.
References
Related vulnerabilities
Recent vulnerabilities recorded for numpy.
