Path Traversal in Python Software Foundation Cpython

CVE-2026-3479

DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if following the intended security model. pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.002 (15.0th percentile) — read the EPSS interpretation.