CVE-2026-23949 jaraco.context Has a Path Traversal Vulnerability
Attackers can extract files outside the intended directory via malicious tar archives in jaraco.context, potentially reading or modifying sensitive files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23949?
CVE-2026-23949 is a high-severity path traversal vulnerability in jaraco.context, published on 20 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
jaraco.context, an open-source software package that provides some useful decorators and context managers, has a Zip Slip path traversal vulnerability in the `jaraco.context.tarball()` function starting in version 5.2.0 and prior to version 6.1.0. The vulnerability may allow attackers to extract files outside the intended extraction directory when malicious tar archives are processed. The strip_first_component filter splits the path on the first `/` and extracts the second component, while allowing `../` sequences. Paths like `dummy_dir/../../etc/passwd` become `../../etc/passwd`. Note that this suffers from a nested tarball attack as well with multi-level tar files such as `dummy_dir/inner.tar.gz`, where the inner.tar.gz includes a traversal `dummy_dir/../../config/.env` that also gets translated to `../../config/.env`. Version 6.1.0 contains a patch for the issue.
Weakness: CWE-22
Which versions are affected by CVE-2026-23949?
3 open source packages ship an affected version, including jaraco.context and jaraco-context. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
jaraco.context PyPI | From 5.2.0 | 6.1.0 |
jaraco-context PyPI | From 5.2.0 | 6.1.0 |
jaraco-context PyPI | From 5.2.0 | 6.1.0 |
Linux distribution packages (4)
python-jaraco.context SUSE:Linux Enterprise Server 16.0 | All versions | 5.3.0-160000.3.1 |
python-jaraco.context SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 5.3.0-160000.3.1 |
python-jaraco.context openSUSE:Leap 16.0 | All versions | 5.3.0-160000.3.1 |
python-jaraco.context openSUSE:Tumbleweed | All versions | 6.1.0-1.1 |
Products include Jaraco Jaraco.context.
How do I fix CVE-2026-23949?
Upgrade jaraco.context to 6.1.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-23949 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-23949 exists.
Sources
Also known as CLEANSTART-2026-JO48164, CLEANSTART-2026-YQ75311, CLSA-2026-1772496730, DEBIAN-CVE-2026-23949, ECHO-4dea-2475-6d75, GHSA-58pv-8j8x-9vj2 and 17 more.