CVE-2026-12345 Python Software Foundation CVE debrief

Who should care

Defenders responsible for CPython deployments should assess exposure and prioritize patching or upgrading to affected versions of CPython. This includes system administrators, security teams, and developers using CPython in their applications.

Why it matters

A race condition vulnerability in tempfile.TemporaryDirectory cleanup allows an attacker to delete files outside the temporary directory or reset their permissions and file flags. Defenders should prioritize patching or upgrading to affected versions of CPython.

• Potential deletion of files outside the temporary directory
• Potential reset of file permissions and flags outside the temporary directory
• Requires verification of affected versions and patching or upgrading
• May require monitoring for exploitation attempts

Technical summary

The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. This issue affects CPython versions before 3.12.15 and 3.15.0rc3. The vulnerability has a CVSS score of 5.9 and is considered medium severity. The vulnerability can be exploited by replacing a directory with a symbolic link during cleanup, allowing files outside of the temporary directory to be deleted or modified.

Defensive priority

Defenders should prioritize patching or upgrading to affected versions of CPython, specifically versions 3.12.15 or later, and 3.15.0rc3 or later.

Recommended defensive actions

• Assess exposure and prioritize patching for CPython versions before 3.12.15 and 3.15.0rc3
• Verify and apply patches or upgrades to affected versions of CPython
• Monitor for and respond to potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to patches and issue tracking. The vulnerability affects CPython versions before 3.12.15 and 3.15.0rc3. The CVE Program record and NVD detail page provide official information on the vulnerability. The source item provides additional details on the vulnerability. The patch and issue tracking references provide additional information on the fix and the issue.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.