CVE-2026-1703CWE-22

Limited path traversal when installing wheel archives

Low · published February 2, 2026

CVSS v4.0
2.0
EPSS
0%
Percentile
37.5
In the wild
Unconfirmed
What it is

When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations.

The record
Technical detail
CVSS v4.0
2.0 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00443 · 37.5th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-02-02T14:43Z
EPSS history
Timeline
  • 02 FEB 14:43Z
    Limited path traversal when installing wheel archives
    cvelistv5