CVE-2026-1703: Limited path traversal when installing wheel archives
Limited path traversal when installing wheel archives
Other sources
When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pipto a version that resolves this vulnerability.Fixed in 26.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1703?
CVE-2026-1703 has a medium severity rating due to its potential for limited path traversal exploitation.
How do I fix CVE-2026-1703?
To mitigate CVE-2026-1703, ensure you are using a patched version of pip that addresses this vulnerability.
What are the implications of CVE-2026-1703?
CVE-2026-1703 may allow an attacker to extract files outside the intended installation directory, leading to unexpected behavior.
Which versions of pip are affected by CVE-2026-1703?
CVE-2026-1703 affects specific versions of pip that do not include the fix for limited path traversal issues.
Is there a way to verify if my pip installation is vulnerable to CVE-2026-1703?
You can check the installed version of pip and compare it with the versions listed in the security advisories to determine vulnerability to CVE-2026-1703.