CVE-2026-12345

A flaw was found in Python. A race condition during the cleanup of temporary directories allows a local attacker with write access to replace a directory with a symbolic link (a reference pointing to another location). This can lead to unauthorized deletion or alteration of files outside the temporary directory, performed with the privileges of the process executing the cleanup.

Last checked: 2026-10-22 01:52 UTC

• No exploitation evidence · CISA Coordinator (Assessed 2026-09-29 18:38 UTC)

References

• NVD: CVE-2026-12345
• Upstream Advisory

Fix Status by Distribution

Fix evidence last checked: 2026-10-21 06:57 UTC