CVE-2025-71176 pytest has vulnerable tmpdir handling
Local attackers can exploit insecure temporary directory creation in pytest to cause denial of service or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-71176?
CVE-2025-71176 is a medium-severity vulnerability in pytest, published on 22 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
pytest through 9.0.2 on UNIX relies on directories with the /tmp/pytest-of-{user} name pattern, which allows local users to cause a denial of service or possibly gain privileges.
Weakness: CWE-379
Which versions are affected by CVE-2025-71176?
3 open source packages ship an affected version, including pytest.
| Package | Affected | Fixed in |
|---|---|---|
pytest PyPI | All versions | 9.0.3 |
pytest PyPI | All versions | 9.0.3 |
pytest PyPI | All versions | 9.0.3 |
Linux distribution packages (3)
pytest Red Hat:hummingbird:1 | All versions | 0:9.0.3-1.hum1 |
python3-pytest Red Hat:hummingbird:1 | All versions | 0:9.0.3-1.hum1 |
python-pytest openSUSE:Tumbleweed | All versions | 9.0.3-1.1 |
How do I fix CVE-2025-71176?
Upgrade pytest to 9.0.3 or later.
Is CVE-2025-71176 being exploited?
There is no known exploitation of CVE-2025-71176 in the wild and no public exploit code.
Sources
Also known as AZL-75014, CLEANSTART-2026-IL46075, CLEANSTART-2026-MP75685, CLSA-2026-1778719541, CLSA-2026-1778719543, DEBIAN-CVE-2025-71176 and 11 more.