Arbitrary file upload in Python Packaging Authority Pip
CVE-2026-3219
pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to t…
Vulnerability class: Unrestricted File Upload
EPSS: 0.001 (4.1th percentile) — read the EPSS interpretation.
Affected products
- Python Packaging Authority Pip — versions 0
Weakness classification (CWE)
References
- cna@python.org (patch)
- cna@python.org (vendor-advisory)
- af854a3a-2127-422b-91ae-364da2661108