CVE-2026-12345
published 2026-09-29CVE-2026-12345: The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a…
PriorityP428medium5.9CVSS 4.0
AVLACLATPPRNUINVCNVIHVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.18%
7.2th percentile
The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flags may still be reset outside of the tree on all platforms.
Affected
56 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform | bootc-automation-portal-rhel9 | — | — |
| container-native-virtualization | ocp-virt-validation-checkup-rhel9 | — | — |
| debian | python3.11 | — | — |
| debian | python3.13 | — | — |
| debian | python3.14 | — | — |
| debian | python3.9 | — | — |
| microsoft | microsoft.netcore.app.runtime.linux-arm | >= 10.0.0 < 10.0.6 | 10.0.6 |
| microsoft | microsoft.netcore.app.runtime.linux-arm | >= 8.0.0 < 8.0.26 | 8.0.26 |
| microsoft | microsoft.netcore.app.runtime.linux-arm | >= 9.0.0 < 9.0.15 | 9.0.15 |
| microsoft | microsoft.netcore.app.runtime.linux-arm64 | >= 10.0.0 < 10.0.6 | 10.0.6 |
| microsoft | microsoft.netcore.app.runtime.linux-arm64 | >= 8.0.0 < 8.0.26 | 8.0.26 |
| microsoft | microsoft.netcore.app.runtime.linux-arm64 | >= 9.0.0 < 9.0.15 | 9.0.15 |
| microsoft | microsoft.netcore.app.runtime.linux-musl-arm | >= 10.0.0 < 10.0.6 | 10.0.6 |
| microsoft | microsoft.netcore.app.runtime.linux-musl-arm | >= 8.0.0 < 8.0.26 | 8.0.26 |
| microsoft | microsoft.netcore.app.runtime.linux-musl-arm | >= 9.0.0 < 9.0.15 | 9.0.15 |
| microsoft | microsoft.netcore.app.runtime.linux-musl-arm64 | >= 10.0.0 < 10.0.6 | 10.0.6 |
| microsoft | microsoft.netcore.app.runtime.linux-musl-arm64 | >= 8.0.0 < 8.0.26 | 8.0.26 |
| microsoft | microsoft.netcore.app.runtime.linux-musl-arm64 | >= 9.0.0 < 9.0.15 | 9.0.15 |
| microsoft | microsoft.netcore.app.runtime.linux-musl-x64 | >= 10.0.0 < 10.0.6 | 10.0.6 |
| microsoft | microsoft.netcore.app.runtime.linux-musl-x64 | >= 8.0.0 < 8.0.26 | 8.0.26 |
| microsoft | microsoft.netcore.app.runtime.linux-musl-x64 | >= 9.0.0 < 9.0.15 | 9.0.15 |
| microsoft | microsoft.netcore.app.runtime.linux-x64 | >= 10.0.0 < 10.0.6 | 10.0.6 |
| microsoft | microsoft.netcore.app.runtime.linux-x64 | >= 8.0.0 < 8.0.26 | 8.0.26 |
| microsoft | microsoft.netcore.app.runtime.linux-x64 | >= 9.0.0 < 9.0.15 | 9.0.15 |
| microsoft | microsoft.netcore.app.runtime.osx-arm64 | >= 10.0.0 < 10.0.6 | 10.0.6 |
CVSS provenance
nvdv4.05.9MEDIUMCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
ghsa7.8HIGH
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
python: python: Arbitrary file deletion via race condition during temporary directory cleanup
vendor_redhat·2026-09-29·CVSS 5.9
CVE-2026-12345 [MEDIUM] CWE-59 python: python: Arbitrary file deletion via race condition during temporary directory cleanup
python: python: Arbitrary file deletion via race condition during temporary directory cleanup
A flaw was found in Python. A race condition during the cleanup of temporary directories allows a local attacker with write access to replace a directory with a symbolic link (a reference pointing to another location). This can lead to unauthorized deletion or alteration of files outside the temporary directory, performed with the privileges of the process executing the cleanup.
Package: python3.12 (Red Hat Enterprise Linux 10) - Affected
Package: python3.14 (Red Hat Enterprise Linux 10) - Fix deferred
Package: python (Red Hat Enterprise Linux 6) - Out of support scope
Package: python (Red Hat Enterprise Linux 7) - Fix deferred
Package: python3 (Red Hat Enterprise Linux 7) - Fix deferred
Pa
GHSA
Gotenberg has case-insensitive URL scheme that bypasses webhook and downloadFrom deny-list SSRF protection
ghsa·2026-04-30·CVSS 7.8
CVE-2026-40280 [HIGH] CWE-918 Gotenberg has case-insensitive URL scheme that bypasses webhook and downloadFrom deny-list SSRF protection
Gotenberg has case-insensitive URL scheme that bypasses webhook and downloadFrom deny-list SSRF protection
## Vulnerability Details
**CWE**: CWE-918 - Server-Side Request Forgery (SSRF)
The default private-IP deny-lists for --webhook-deny-list and --api-download-from-deny-list use a case-sensitive regex (^https?://). Any uppercase URL scheme variant (HTTP://, HTTPS://, Http://) bypasses the pattern. Go's net/url.Parse() normalizes the scheme to lowercase when making the outbound TCP connection, so the connection succeeds normally. Affected: pkg/gotenberg/filter.go:FilterDeadline(), pkg/modules/webhook/webhook.go:42, pkg/modules/api/api.go:199. Confirmed in Docker: http://172.17.0.1:12345/ returns HTTP 403 (blocked), HTTP://172.17.0.1:12345/ returns HTTP 202 (bypassed, TCP connection att
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-12345 asahi-installer: python: Arbitrary file deletion via race condition during temporary directory cleanup [epel-all]
bugzilla·2026-10-07·CVSS 5.9
CVE-2026-12345 [MEDIUM] CVE-2026-12345 asahi-installer: python: Arbitrary file deletion via race condition during temporary directory cleanup [epel-all]
CVE-2026-12345 asahi-installer: python: Arbitrary file deletion via race condition during temporary directory cleanup [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file f
Bugzilla
CVE-2026-12345 python3.13: python: Arbitrary file deletion via race condition during temporary directory cleanup [epel-all]
bugzilla·2026-10-07·CVSS 5.9
CVE-2026-12345 [MEDIUM] CVE-2026-12345 python3.13: python: Arbitrary file deletion via race condition during temporary directory cleanup [epel-all]
CVE-2026-12345 python3.13: python: Arbitrary file deletion via race condition during temporary directory cleanup [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flags
Bugzilla
CVE-2026-12345 python3.9: python: Arbitrary file deletion via race condition during temporary directory cleanup [fedora-all]
bugzilla·2026-10-07·CVSS 5.9
CVE-2026-12345 [MEDIUM] CVE-2026-12345 python3.9: python: Arbitrary file deletion via race condition during temporary directory cleanup [fedora-all]
CVE-2026-12345 python3.9: python: Arbitrary file deletion via race condition during temporary directory cleanup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flags
Bugzilla
CVE-2026-12345 python3.10: python: Arbitrary file deletion via race condition during temporary directory cleanup [fedora-all]
bugzilla·2026-10-07·CVSS 5.9
CVE-2026-12345 [MEDIUM] CVE-2026-12345 python3.10: python: Arbitrary file deletion via race condition during temporary directory cleanup [fedora-all]
CVE-2026-12345 python3.10: python: Arbitrary file deletion via race condition during temporary directory cleanup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flag
Bugzilla
CVE-2026-12345 python3.15: python: Arbitrary file deletion via race condition during temporary directory cleanup [fedora-all]
bugzilla·2026-10-07·CVSS 5.9
CVE-2026-12345 [MEDIUM] CVE-2026-12345 python3.15: python: Arbitrary file deletion via race condition during temporary directory cleanup [fedora-all]
CVE-2026-12345 python3.15: python: Arbitrary file deletion via race condition during temporary directory cleanup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flag
Bugzilla
CVE-2026-12345 python3.6: python: Arbitrary file deletion via race condition during temporary directory cleanup [fedora-all]
bugzilla·2026-10-07·CVSS 5.9
CVE-2026-12345 [MEDIUM] CVE-2026-12345 python3.6: python: Arbitrary file deletion via race condition during temporary directory cleanup [fedora-all]
CVE-2026-12345 python3.6: python: Arbitrary file deletion via race condition during temporary directory cleanup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flags
Bugzilla
CVE-2026-12345 python3.14: python: Arbitrary file deletion via race condition during temporary directory cleanup [fedora-all]
bugzilla·2026-10-07·CVSS 5.9
CVE-2026-12345 [MEDIUM] CVE-2026-12345 python3.14: python: Arbitrary file deletion via race condition during temporary directory cleanup [fedora-all]
CVE-2026-12345 python3.14: python: Arbitrary file deletion via race condition during temporary directory cleanup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flag
Bugzilla
CVE-2026-12345 python3.12: python: Arbitrary file deletion via race condition during temporary directory cleanup [fedora-all]
bugzilla·2026-10-07·CVSS 5.9
CVE-2026-12345 [MEDIUM] CVE-2026-12345 python3.12: python: Arbitrary file deletion via race condition during temporary directory cleanup [fedora-all]
CVE-2026-12345 python3.12: python: Arbitrary file deletion via race condition during temporary directory cleanup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flag
Bugzilla
CVE-2026-12345 python3.13: python: Arbitrary file deletion via race condition during temporary directory cleanup [fedora-all]
bugzilla·2026-10-07·CVSS 5.9
CVE-2026-12345 [MEDIUM] CVE-2026-12345 python3.13: python: Arbitrary file deletion via race condition during temporary directory cleanup [fedora-all]
CVE-2026-12345 python3.13: python: Arbitrary file deletion via race condition during temporary directory cleanup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flag
Bugzilla
CVE-2026-12345 python3.11: python: Arbitrary file deletion via race condition during temporary directory cleanup [fedora-all]
bugzilla·2026-10-07·CVSS 5.9
CVE-2026-12345 [MEDIUM] CVE-2026-12345 python3.11: python: Arbitrary file deletion via race condition during temporary directory cleanup [fedora-all]
CVE-2026-12345 python3.11: python: Arbitrary file deletion via race condition during temporary directory cleanup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flag
Bugzilla
CVE-2026-12345 asahi-installer: python: Arbitrary file deletion via race condition during temporary directory cleanup [fedora-all]
bugzilla·2026-10-07·CVSS 5.9
CVE-2026-12345 [MEDIUM] CVE-2026-12345 asahi-installer: python: Arbitrary file deletion via race condition during temporary directory cleanup [fedora-all]
CVE-2026-12345 asahi-installer: python: Arbitrary file deletion via race condition during temporary directory cleanup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file
Bugzilla
CVE-2026-12345 mingw-python3: python: Arbitrary file deletion via race condition during temporary directory cleanup [fedora-all]
bugzilla·2026-10-07·CVSS 5.9
CVE-2026-12345 [MEDIUM] CVE-2026-12345 mingw-python3: python: Arbitrary file deletion via race condition during temporary directory cleanup [fedora-all]
CVE-2026-12345 mingw-python3: python: Arbitrary file deletion via race condition during temporary directory cleanup [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file f
Bugzilla
CVE-2026-12345 python: python: Arbitrary file deletion via race condition during temporary directory cleanup
bugzilla·2026-09-29·CVSS 5.9
CVE-2026-12345 [MEDIUM] CVE-2026-12345 python: python: Arbitrary file deletion via race condition during temporary directory cleanup
CVE-2026-12345 python: python: Arbitrary file deletion via race condition during temporary directory cleanup
The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flags may still be reset outside of the tree on all platforms.
https://github.com/python/cpython/commit/06ef3d43fdaf4da97af12fa694b4886092c4b970https://github.com/python/cpython/commit/458e7134a5af7f86aee9d21b51cf499b41aa4420https://github.com/python/cpython/commit/58ed0259cae509a19138795df302fe60b544dc74https://github.com/python/cpython/commit/5c20517a4fc56683efe63a7751020db9573f538dhttps://github.com/python/cpython/commit/e1f3590f155c6d66007e958c98c9d69316551993https://github.com/python/cpython/issues/157579https://github.com/python/cpython/pull/157580http://www.openwall.com/lists/oss-security/2026/09/29/40
2026-09-29
Published