CVE-2025-71176: pytest
CVSS: 6.8v3.1MediumDeferred
AliasesGHSA-6w46-j5rx-g56gPYSEC-2026-1845RHSA-2026:8580UBUNTU-CVE-2025-71176DEBIAN-CVE-2025-71176CGA-36r3-2vmv-5g74CGA-84f9-c4gj-7hgpCGA-cv98-4j9m-943mCGA-ghmj-36mv-h9f9openSUSE-SU-2026:10666-1CGA-4ph3-v24c-3hxrCGA-5g2m-cgh9-xg23CGA-67x3-mvf6-hwv2CGA-73qv-mqff-hrjrCGA-7g7r-2jwh-hmm7CGA-cj9h-p6jj-9j8pCGA-fr3f-4jvj-78cwCGA-frmx-4mwf-fqj7CGA-g4pj-rqcw-jw28CGA-m5j2-q63p-r5rf
Published 22-01-2026Last modified 22-01-2026
Vulnerability summary
CVE-2025-71176 is a medium (CVSS 6.8) vulnerability in pytest. EPSS estimates a 0.15% chance of exploitation in the next 30 days, higher than 4% of scored vulnerabilities.
CVSS score
6.8/10
010
Medium · v3.1 (CVE.org)EPSS score
0.15%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 22-01-2026PublishedVulnerability first disclosed.
- 22-01-2026Last modifiedVulnerability information updated.
Description
pytest through 9.0.2 on UNIX relies on directories with the /tmp/pytest-of-{user} name pattern, which allows local users to cause a denial of service or possibly gain privileges.
CVSS metrics
8 scores · 8 sources · 1 versionMedium 6.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:LSourcesAll 8 agree
- OSV · PypiEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
- OSV · Red hatEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
- OSV · UbuntuEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
- OSV · DebianEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
- OSV · WolfiEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
- OSV · ChainguardEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
- NVDNIST6.8MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
EPSS trend
Probability
0.15%
Chance of exploitation in the next 30 days
Percentile
4%
Versus all other CVEs
30-day change
0.00 pp
From 0.16% on 19-09-2026
19-09-202619-10-2026
EPSS score0.15%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard7 products
- apache-beam-python-3.11-sdk< 2.72.0-r3
- apache-beam-python-3.12-sdk< 2.72.0-r3
- apache-beam-python-3.13-sdk< 2.73.0-r2
- localstack< 4.14.0-r8
- open-webui< 0.9.2-r0 | < 0.8.12-r4
Redhat2 products
- pytest< 0:9.0.3-1.hum1
- python3-pytest< 0:9.0.3-1.hum1
Wolfi2 products
- open-webui< 0.9.2-r0 | < 0.8.12-r4
- py3-cassandra-medusa< 0.28.0-r0
Debian1 product
- pytestAll versions (No fix recorded)
Opensuse1 product
- python-pytest&distro=openSUSE Tumbleweed< 9.0.3-1.1
PyPI1 product
- pytest< 9.0.3
Pytest1 product
- pytest≤ 9.0.2
Ubuntu1 product
- pytestAll versions (No fix recorded)
8 vendors · 16 products
References
20 links
- github.com/pytest-dev/pytesPACKAGE
- pypi.org/project/pytestPACKAGE
Show all 20 references
- images.redhat.comARTICLE
