CVE-2026-1703 Limited path traversal when installing wheel archives
Attackers can extract files outside the installation directory via malicious wheel archives, potentially modifying data in prefix directories.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-1703?
CVE-2026-1703 is a low-severity path traversal vulnerability in Python Packaging Authority pip, published on 2 Feb 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations.
Weakness: CWE-22
Which versions are affected by CVE-2026-1703?
3 open source packages ship an affected version, including pip.
| Package | Affected | Fixed in |
|---|---|---|
pip PyPI | All versions | 26.0 |
pip PyPI | All versions | 26.0 |
pip PyPI | All versions | 26.0 |
Linux distribution packages (11)
python-pip Red Hat:hummingbird:1 | All versions | 0:26.0.1-2.1.hum1 |
python-pip-wheel Red Hat:hummingbird:1 | All versions | 0:26.0.1-2.1.hum1 |
python-pip SUSE:Linux Enterprise Module for Public Cloud 15 SP4 | All versions | 22.3.1-150400.17.19.1 |
python-pip SUSE:Linux Enterprise Module for Python 3 15 SP7 | All versions | 22.3.1-150400.17.19.1 |
python-pip SUSE:Linux Enterprise Server 16.0 | All versions | 25.0.1-160000.3.1 |
python-pip SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 10.0.1-13.17.1 |
python-pip SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 10.0.1-13.23.2 |
python-pip SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 25.0.1-160000.3.1 |
python-pip openSUSE:Leap 15.6 | All versions | 22.3.1-150400.17.19.1 |
python-pip openSUSE:Leap 16.0 | All versions | 25.0.1-160000.3.1 |
python-pip openSUSE:Tumbleweed | All versions | 26.0.1-1.1 |
How do I fix CVE-2026-1703?
Upgrade pip to 26.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-1703 being exploited?
There is no known exploitation of CVE-2026-1703 in the wild and no public exploit code.
Sources
Also known as AZL-76496, AZL-76499, AZL-76593, AZL-76599, AZL-77910, BELL-CVE-2026-1703 and 24 more.