CVE-2026-3479: Python pkgutil Path Traversal Vulnerability

CVE-2026-3479 Overview

CVE-2026-3479 is a Path Traversal vulnerability in Python's pkgutil.get_data() function. The function failed to validate the resource argument as documented, allowing attackers to traverse directory structures using path traversal sequences. This weakness (CWE-22) enables unauthorized access to files outside the intended package directory when the function is called with malicious input.

Critical Impact

Attackers can leverage the path traversal flaw to read arbitrary files on the system by supplying specially crafted resource paths containing parent directory components (..) or absolute paths to pkgutil.get_data().

Affected Products

• Python CPython (versions prior to security patch)

Discovery Timeline

• March 18, 2026 - CVE CVE-2026-3479 published to NVD
• March 19, 2026 - Last updated in NVD database

Technical Details for CVE-2026-3479

Vulnerability Analysis

The vulnerability exists in Python's pkgutil module, specifically within the get_data() function. According to the documentation, this function should only accept valid relative resource paths within a package. However, the implementation failed to enforce this constraint, allowing both absolute paths and paths containing parent directory traversal components (..) to be processed.

When a malicious resource argument is passed to pkgutil.get_data(), the function constructs a file path by joining the package's directory with the untrusted resource input. Without proper validation, an attacker can escape the package directory and access arbitrary files accessible by the Python process.

Root Cause

The root cause stems from insufficient input validation in the pkgutil.get_data() function. The function did not verify that the resource argument was a valid relative path without parent directory components. The code directly split the resource path and joined it with the package directory, trusting the input without sanitization.

Attack Vector

This vulnerability requires local access to execute malicious Python code that calls pkgutil.get_data() with a crafted resource path. An attacker with the ability to influence application code or supply input that reaches this function can read files outside the package directory, potentially accessing sensitive configuration files, credentials, or other system data.

The attack involves passing path traversal sequences such as ../../../etc/passwd or absolute paths like /etc/shadow as the resource argument. The function would then resolve these paths and return their contents to the attacker.

# Security patch in Lib/pkgutil.py
# Source: https://github.com/python/cpython/commit/bcdf231946b1da8bdfbab4c05539bb0cc964a1c7

     # signature - an os.path format "filename" starting with the dirname of
     # the package's __file__
     parts = resource.split('/')
+    if os.path.isabs(resource) or '..' in parts:
+        raise ValueError("resource must be a relative path with no "
+                         "parent directory components")
     parts.insert(0, os.path.dirname(mod.__file__))
     resource_name = os.path.join(*parts)
     return loader.get_data(resource_name)

Source: GitHub Commit Update

Detection Methods for CVE-2026-3479

Indicators of Compromise

• Application logs showing pkgutil.get_data() calls with resource arguments containing .. sequences
• Unexpected file access attempts outside package directories in audit logs
• Error messages indicating attempts to access system files through Python package utilities

Detection Strategies

• Monitor Python application logs for suspicious pkgutil.get_data() calls with path traversal patterns
• Implement static code analysis to identify untrusted input reaching pkgutil.get_data() without validation
• Deploy runtime application security monitoring to detect file access anomalies

Monitoring Recommendations

• Enable Python audit hooks to log calls to pkgutil.get_data() with their arguments
• Monitor file system access patterns for processes running Python applications
• Review application code for instances where user-controlled data may reach pkgutil.get_data()

How to Mitigate CVE-2026-3479

Immediate Actions Required

• Update Python to the latest patched version containing the security fix
• Review application code for usage of pkgutil.get_data() with untrusted input
• Implement input validation to reject resource arguments containing .. or absolute paths before calling pkgutil.get_data()

Patch Information

The Python development team has released a security patch that adds proper validation to pkgutil.get_data(). The fix rejects resource arguments that are absolute paths or contain parent directory components, raising a ValueError with a descriptive message. For complete details, refer to the GitHub Pull Request, GitHub Issue Discussion, and the Python Security Announcement.

Workarounds

• Validate resource arguments before passing them to pkgutil.get_data() by checking for .. components and absolute paths
• Use application-level path sanitization to ensure only valid relative package paths are processed
• Implement allowlisting of permitted resource names if the set of valid resources is known

# Workaround: Validate resource paths before calling pkgutil.get_data()
import os

def safe_get_data(package, resource):
    parts = resource.split('/')
    if os.path.isabs(resource) or '..' in parts:
        raise ValueError("Invalid resource path")
    return pkgutil.get_data(package, resource)