CPython [CVE-2026-12345] Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory
CVE-2026-12345 in CPython: race condition in tempfile.TemporaryDirectory cleanup can delete files outside the temporary directory.
An oss-security post forwarded from Python's security-announce list discloses CVE-2026-12345, a race condition in CPython's tempfile.TemporaryDirectory cleanup. The flaw allows files outside the temporary directory to be deleted during cleanup. The advisory was posted on September 29, 2026, by Stan Ulbrych via the Python security-announce list.
- Race condition in tempfile.TemporaryDirectory cleanup can delete files outside the temporary directory.
- Tracked as CVE-2026-12345; disclosed via Python security-announce and forwarded to oss-security.
Vulnerabilities mentionedAll →
- CVE-2026-123455.9<1%Race condition in CPython TemporaryDirectory cleanuppublished · Python Software Foundation CPython PoC
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-12345 | Race condition in CPython TemporaryDirectory cleanup |
Posted by Alan Coopersmith on Sep 29 -------- Forwarded Message -------- Subject: [Security-announce][CVE-2026-12345] Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory Date: Tue, 29 Sep 2026 18:28:51 +0100 From: Stan Ulbrych via Security-announce Reply-To: security-sig () python org To: security-announce () python org CC: Stan Ulbrych <stanulbrych () gmail...
This source does not provide full text. Read it at seclists.org.