A flaw was found in Python. A race condition during the cleanup of temporary directories allows a local attacker with write access to replace a directory with a symbolic link (a reference pointing to another location). This can lead to unauthorized deletion or alteration of files outside the temporary directory, performed with the privileges of the process executing the cleanup.
Last checked: 2026-09-30 23:59 UTC
No exploitation evidence · CISA Coordinator (Assessed 2026-09-29 18:38 UTC)
Fix evidence last checked: 2026-09-29 19:37 UTC