CVE-2026-12345 Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory
Attackers can exploit a race condition in tempfile cleanup to delete files or reset permissions outside the temporary directory via symlink attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-12345?
CVE-2026-12345 is a medium-severity vulnerability in CPython, published on 29 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flags may still be reset outside of the tree on all platforms.
Weakness: CWE-59
Which versions are affected by CVE-2026-12345?
3 open source packages ship an affected version, including libpython, python and python-min.
| Package | Affected | Fixed in |
|---|---|---|
libpython Bitnami | All versions | 3.12.16, 3.13.18, 3.14.9 |
python Bitnami | All versions | 3.12.16, 3.13.18, 3.14.9 |
python-min Bitnami | All versions | 3.12.16, 3.13.18, 3.14.9 |
Linux distribution packages (32)
python-unversioned-command Red Hat:hummingbird:1 | All versions | 0:3.14.8-1.hum1 |
python3 Red Hat:hummingbird:1 | All versions | 0:3.14.8-1.hum1 |
python3-debug Red Hat:hummingbird:1 | All versions | 0:3.14.8-1.hum1 |
python3-devel Red Hat:hummingbird:1 | All versions | 0:3.14.8-1.hum1 |
python3-idle Red Hat:hummingbird:1 | All versions | 0:3.14.8-1.hum1 |
python3-libs Red Hat:hummingbird:1 | All versions | 0:3.14.8-1.hum1 |
python3-test Red Hat:hummingbird:1 | All versions | 0:3.14.8-1.hum1 |
python3-tkinter Red Hat:hummingbird:1 | All versions | 0:3.14.8-1.hum1 |
python3.12 Red Hat:hummingbird:1 | All versions | 0:3.12.15-1.hum1 |
python3.12-debug Red Hat:hummingbird:1 | All versions | 0:3.12.15-1.hum1 |
python3.12-devel Red Hat:hummingbird:1 | All versions | 0:3.12.15-1.hum1 |
python3.12-idle Red Hat:hummingbird:1 | All versions | 0:3.12.15-1.hum1 |
python3.12-libs Red Hat:hummingbird:1 | All versions | 0:3.12.15-1.hum1 |
python3.12-test Red Hat:hummingbird:1 | All versions | 0:3.12.15-1.hum1 |
python3.12-tkinter Red Hat:hummingbird:1 | All versions | 0:3.12.15-1.hum1 |
python3.13 Red Hat:hummingbird:1 | All versions | 0:3.13.16-1.hum1 |
python3.13-debug Red Hat:hummingbird:1 | All versions | 0:3.13.16-1.hum1 |
python3.13-devel Red Hat:hummingbird:1 | All versions | 0:3.13.16-1.hum1 |
python3.13-freethreading Red Hat:hummingbird:1 | All versions | 0:3.13.16-1.hum1 |
python3.13-freethreading-debug Red Hat:hummingbird:1 | All versions | 0:3.13.16-1.hum1 |
python3.13-idle Red Hat:hummingbird:1 | All versions | 0:3.13.16-1.hum1 |
python3.13-libs Red Hat:hummingbird:1 | All versions | 0:3.13.16-1.hum1 |
python3.13-test Red Hat:hummingbird:1 | All versions | 0:3.13.16-1.hum1 |
python3.13-tkinter Red Hat:hummingbird:1 | All versions | 0:3.13.16-1.hum1 |
python3.14 Red Hat:hummingbird:1 | All versions | 0:3.14.8-1.hum1 |
python3.14-freethreading Red Hat:hummingbird:1 | All versions | 0:3.14.8-1.hum1 |
python3.14-freethreading-debug Red Hat:hummingbird:1 | All versions | 0:3.14.8-1.hum1 |
python3.14-freethreading-devel Red Hat:hummingbird:1 | All versions | 0:3.14.8-1.hum1 |
python3.14-freethreading-idle Red Hat:hummingbird:1 | All versions | 0:3.14.8-1.hum1 |
python3.14-freethreading-libs Red Hat:hummingbird:1 | All versions | 0:3.14.8-1.hum1 |
python3.14-freethreading-test Red Hat:hummingbird:1 | All versions | 0:3.14.8-1.hum1 |
python3.14-freethreading-tkinter Red Hat:hummingbird:1 | All versions | 0:3.14.8-1.hum1 |
How do I fix CVE-2026-12345?
Upgrade libpython to a fixed version for your release line: 3.12.16, 3.13.18 or 3.14.9.
Is CVE-2026-12345 being exploited?
There is no known exploitation of CVE-2026-12345 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as ALPINE-CVE-2026-12345, AZL-105684, AZL-105912, BELL-CVE-2026-12345, BIT-libpython-2026-12345, BIT-python-2026-12345 and 11 more.