{
  "cveId": "CVE-2026-1703",
  "url": "https://patchblox.com/security/cve/CVE-2026-1703",
  "summary": "CVE-2026-1703 is fixed in 13 products on 1 platform, first by DEBIAN-CVE-2026-1703, released February 2, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "Limited path traversal when installing wheel archives",
  "description": "This update for python3 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the\n  \u0060configparser\u0060 module is used (bsc#1269066).\n- CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting maliciously\n  crafted wheel archives (bsc#1257599 bsc#1274743).\n- CVE-2026-3219: pip doesn\u0027t reject concatenated ZIP (bsc#1262429 bsc#1262467).\n- CVE-2026-3276: quadratic complexity in \u0060unicodedata.normalize()\u0060 can lead to DoS when processing specially crafted\n  Unicode input (bsc#1267581).\n- CVE-2026-3446: Base64 decoding stops at first padded quad by default (bsc#1261970).\n- CVE-2026-3479: python: improper resource argument validation can allow path traversal (bsc#1259989).\n- CVE-2026-4224: C stack overflow when parsing XML with deeply nested DTD content models (bsc#1259735).\n- CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when extracting\n  hardlinks (bsc#1269959).\n- CVE-2026-6357: pip self-update functionality can import newly installed modules after wheel installation (bsc#1263442\n  bsc#1263443).\n- CVE-2026-6879: quadratic behavior in \u0060xml.etree.ElementPath\u0060 index predicates can lead to a denial of service via high\n  CPU usage (bsc#1273148).\n- CVE-2026-7210: \u0060xml.parsers.expat\u0060 and \u0060xml.etree.ElementTree\u0060 use insufficient entropy for Expat hash-flooding\n  protection (bsc#1264962).\n- CVE-2026-7774: \u0060tarfile.data_filter\u0060 path traversal bypass allows writing outside the extraction directory\n  (bsc#1267821).\n- CVE-2026-8328: \u0060ftpcp()\u0060 does not use actual peer address and trusts server-supplied PASV host address (bsc#1265268).\n- CVE-2026-8643: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite\n  (bsc#1266669).\n- CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974).\n- CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination directory and\n  enables arbitrary file reads and writes (bsc#1268977).\n- CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead to DoS\n  (bsc#1269788).\n- CVE-2026-13346: Arbitrary file installation via malicious package indexes (bsc#1273090 bsc#1273091 bsc#1273094).\n- CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations\n  (bsc#1271192).\n- CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).\n- CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223).\n- CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226).\n- CVE-2026-18503: attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect\n  sniffing and consume significant CPU (bsc#1274683).\n- CVE-2026-19672: tarfile extraction filter bypass allows creation of directories outside the destination (bsc#1276227).\n- CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link, allowing file\n  modification and content disclosure (bsc#1280459).\n\nNon security issue fixed:\n\n- Fix an error that returned non-zero exit status 1 (bsc#1277271).\n- Fix regression in \u0060http.cookies\u0060 (bsc#1263083).  \n- Update bundled pip wheels to pip-20.0.2-py2.py3-none-any.whl.",
  "published": "2026-02-02T15:16:30Z",
  "severity": "Low",
  "cwe": "Improper Limitation of a Pathname to a Restricted Directory (\u0026#39;Path Traversal\u0026#39;)",
  "epss": 0.00436,
  "epssPercentile": 0.38179,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-1703",
  "fixes": [
    {
      "platform": "linux",
      "product": "python",
      "release": "sles 15.7",
      "fixedVersion": "2.7.18-150000.126.1",
      "fix": "SUSE-SU-2026:3969-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3969-1",
      "released": "2026-09-04T08:20:04Z"
    },
    {
      "platform": "linux",
      "product": "python-base",
      "release": "sles 15.7",
      "fixedVersion": "2.7.18-150000.126.1",
      "fix": "SUSE-SU-2026:3969-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3969-1",
      "released": "2026-09-04T08:20:04Z"
    },
    {
      "platform": "linux",
      "product": "python-pip",
      "release": "Debian 14",
      "fixedVersion": "26.0\u002Bdfsg-1",
      "fix": "DEBIAN-CVE-2026-1703",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-1703",
      "released": "2026-02-02T15:16:30Z"
    },
    {
      "platform": "linux",
      "product": "python-pip",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "22.3.1-150400.17.19.1",
      "fix": "SUSE-SU-2026:0805-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0805-1",
      "released": "2026-03-04T12:58:41Z"
    },
    {
      "platform": "linux",
      "product": "python-pip",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "25.0.1-160000.3.1",
      "fix": "OPENSUSE-SU-2026:20202-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-20202-1",
      "released": "2026-02-11T19:17:08Z"
    },
    {
      "platform": "linux",
      "product": "python-pip",
      "release": "sles 15.7",
      "fixedVersion": "22.3.1-150400.17.19.1",
      "fix": "SUSE-SU-2026:0805-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0805-1",
      "released": "2026-03-04T12:58:41Z"
    },
    {
      "platform": "linux",
      "product": "python-pip",
      "release": "sles 16.0",
      "fixedVersion": "25.0.1-160000.4.1",
      "fix": "SUSE-SU-2026:22018-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-22018-1",
      "released": "2026-06-02T13:37:13Z"
    },
    {
      "platform": "linux",
      "product": "python3",
      "release": "sles 15.6",
      "fixedVersion": "3.6.15-150300.10.129.1",
      "fix": "SUSE-SU-2026:4754-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4754-1",
      "released": "2026-11-07T00:42:08Z"
    },
    {
      "platform": "linux",
      "product": "python3",
      "release": "sles 15.7",
      "fixedVersion": "3.6.15-150300.10.129.1",
      "fix": "SUSE-SU-2026:4754-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4754-1",
      "released": "2026-11-07T00:42:08Z"
    },
    {
      "platform": "linux",
      "product": "python3-core",
      "release": "sles 15.6",
      "fixedVersion": "3.6.15-150300.10.129.1",
      "fix": "SUSE-SU-2026:4754-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4754-1",
      "released": "2026-11-07T00:42:08Z"
    },
    {
      "platform": "linux",
      "product": "python3-core",
      "release": "sles 15.7",
      "fixedVersion": "3.6.15-150300.10.129.1",
      "fix": "SUSE-SU-2026:4754-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4754-1",
      "released": "2026-11-07T00:42:08Z"
    },
    {
      "platform": "linux",
      "product": "python3-pip",
      "release": "amzn 2023",
      "fixedVersion": "21.3.1-2.amzn2023.0.17",
      "fix": "ALAS2023-2026-1589",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1589",
      "released": "2026-04-27T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-pip-wheel",
      "release": "amzn 2023",
      "fixedVersion": "21.3.1-2.amzn2023.0.17",
      "fix": "ALAS2023-2026-1589",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1589",
      "released": "2026-04-27T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python3.11-pip",
      "release": "amzn 2023",
      "fixedVersion": "22.3.1-2.amzn2023.0.11",
      "fix": "ALAS2023-2026-1531",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1531",
      "released": "2026-03-30T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python3.11-pip-wheel",
      "release": "amzn 2023",
      "fixedVersion": "22.3.1-2.amzn2023.0.11",
      "fix": "ALAS2023-2026-1531",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1531",
      "released": "2026-03-30T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python3.12-pip",
      "release": "amzn 2023",
      "fixedVersion": "23.2.1-4.amzn2023.0.8",
      "fix": "ALAS2023-2026-1530",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1530",
      "released": "2026-03-30T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python3.12-pip-wheel",
      "release": "amzn 2023",
      "fixedVersion": "23.2.1-4.amzn2023.0.8",
      "fix": "ALAS2023-2026-1530",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1530",
      "released": "2026-03-30T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python3.13-pip",
      "release": "amzn 2023",
      "fixedVersion": "24.2-259.amzn2023.0.4",
      "fix": "ALAS2023-2026-1490",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1490",
      "released": "2026-03-16T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python3.13-pip-wheel",
      "release": "amzn 2023",
      "fixedVersion": "24.2-259.amzn2023.0.4",
      "fix": "ALAS2023-2026-1490",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1490",
      "released": "2026-03-16T09:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}