CVE-2025-50817: Path Traversal
A vulnerability in Python-Future modules 0.14.0 and above allows for arbitrary code execution via the unintended import of a file named test.py. When the module is loaded, it automatically imports test.py, if present in the same directory or in the sys.path. This behavior can be exploited by an attacker who has the ability to write files to the server, allowing the execution of arbitrary code.
Other sources
A vulnerability in the Python-Future 1.0.0 module allows for arbitrary code execution via the unintended import of a file named test.py. When the module is loaded, it automatically imports test.py, if present in the same directory or in the sys.path. This behavior can be exploited by an attacker who has the ability to write files to the server, allowing the execution of arbitrary code.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-50817?
CVE-2025-50817 is categorized as a high severity vulnerability due to its potential for arbitrary code execution.
How do I fix CVE-2025-50817?
To mitigate CVE-2025-50817, remove any unintended 'test.py' files in the working directory or adjust your directory structure.
What software versions are affected by CVE-2025-50817?
CVE-2025-50817 affects Python-Future modules version 0.14.0 and above.
How can CVE-2025-50817 be exploited?
CVE-2025-50817 can be exploited by placing a malicious 'test.py' file in the same directory as the Python-Future module, which gets imported automatically.
Is there a patch available for CVE-2025-50817?
No specific patch has been mentioned for CVE-2025-50817; the recommended action is to manage the presence of 'test.py' files accordingly.