Skip to content

Race condition in the cleanup of tempfile.TemporaryDirectory #157579

Open
Open
Race condition in the cleanup of tempfile.TemporaryDirectory#157579
Assignees
StanFromIreland
Labels
3.10only security fixes3.11only security fixes3.12only security fixes3.13bugs and security fixes3.14bugs and security fixes3.16new features, bugs and security fixesstdlibStandard Library Python modules in the Lib/ directorytype-securityA security issue

Description

@StanFromIreland
StanFromIreland
opened on Sep 15, 2026

When working around file system permission errors, files are removed after resolving their path again, this means that by replacing a directory of the tree with a symbolic link, an attacker can make the cleanup delete files outside of the temporary directory.

Linked PRs

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

3.10only security fixes3.11only security fixes3.12only security fixes3.13bugs and security fixes3.14bugs and security fixes3.16new features, bugs and security fixesstdlibStandard Library Python modules in the Lib/ directorytype-securityA security issue

Projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions