CVE-2019-20916: Path Traversal in pip
Summary
CVE-2019-20916: Path Traversal in pip. Affects pip versions < 19.2. Fixed in 19.2. How to fix ↓
Also tracked for
- python-pip · Debian:11
The same CVE-2019-20916 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pip package is a popular package manager for Python that allows users to easily install and manage Python packages. It is widely used in the Python ecosystem and is a critical component for many Python projects. However, the pip package before version 19.2 is vulnerable to a Path Traversal vulnerability. This vulnerability allows an attacker to traverse directories and overwrite files on the system by providing a specially crafted URL in an install command. The vulnerability exists in the _download_http_url function in the _internal/download.py file. The issue was fixed in version 19.2 of the pip package.
Vulnerability Detail
The Path Traversal vulnerability in pip arises due to improper handling of the Content-Disposition header when a URL is provided in an install command. By including '../' in the filename of the Content-Disposition header, an attacker can bypass directory restrictions and overwrite files on the system. This can lead to unauthorized access, data loss, or even remote code execution depending on the specific file that is overwritten. The vulnerability has a CVSS score of 7.5, indicating a high severity.
How To Fix
Latest published version: 26.2.2 as of 22 Oct 2026
pip install --upgrade "pip==26.2.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
19.2
This is the first release that contains the fix.
pip install --upgrade "pip==19.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of the pip package as soon as possible.
Conclusion
The Path Traversal vulnerability in the pip package before version 19.2 poses a significant risk to systems using older versions of the package. It allows an attacker to overwrite files on the system, potentially leading to unauthorized access, data loss, or remote code execution. To mitigate this risk, it is crucial to update to the fixed version of the pip package (19.2 or later). For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pip →
FAQ
This vulnerability allows an attacker to overwrite files on the system, potentially leading to unauthorized access, data loss, or remote code execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock and Vulert will analyze it for any open-source vulnerabilities, including this one.
While there is no known public exploit for this vulnerability, it is still important to update to the fixed version of the pip package to mitigate the risk.
The only effective mitigation for this vulnerability is to update to the fixed version of the pip package.
Yes, this vulnerability can be exploited remotely if the affected system is accessible over the network.
References
Related vulnerabilities
Recent vulnerabilities recorded for pip.
