en
The Python Packaging Authority (PyPA) is a collaborative working group that maintains core projects and standards for Python software packaging. Its mission covers package creation, distribution, installation, and interoperability, serving the global Python open-source community and organizations that build or deploy Python software.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-13346Absolute path traversal in Python Packaging Authority pip can place files outside intended directoriesCVE-2026-8643pip can extract console_scripts and gui_scripts outside installation directoryCVE-2026-3219pip doesn't reject concatenated ZIP and tar archivesCVE-2026-1703Limited path traversal when installing wheel archivesCVE-2025-8869Fallback tar extraction in pip doesn't check symbolic links point to extraction directory| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-13346Absolute path traversal in Python Packaging Authority pip can place files outside intended directories | Exploitation statusNot exploited | FixYes | Affected productpip | Published07/29/2026 | SeverityMedium |
CVE-2026-8643pip can extract console_scripts and gui_scripts outside installation directory | Exploitation statusNot exploited | FixYes | Affected productpip | Published | |
CVE-2026-3219pip doesn't reject concatenated ZIP and tar archives | Exploitation statusNot exploited | FixYes | Affected productpip | Published04/20/2026 | |
CVE-2026-1703Limited path traversal when installing wheel archives | Exploitation statusNot exploited | FixYes | Affected productpip | Published02/02/2026 | |
CVE-2025-8869Fallback tar extraction in pip doesn't check symbolic links point to extraction directory | Exploitation statusNot exploited | FixYes | Affected productpip | Published |
5 Results | Page 1 of 1
| SeverityMedium |
| SeverityMedium |
| SeverityLow |
| SeverityMedium |