CVE-2026-13346: pypa pip Absolute Path Traversal
CVSS: 6.5v3.1MediumAnalyzed
AliasesSUSE-SU-2026:23319-1SUSE-SU-2026:3588-1SUSE-SU-2026:3589-1SUSE-SU-2026:3846-1SUSE-SU-2026:4030-1GHSA-qwm4-qh6w-59xrPYSEC-2026-3721UBUNTU-CVE-2026-13346DEBIAN-CVE-2026-13346CGA-2p6c-44pq-7cf7CGA-3794-p692-jf92CGA-52pw-hq5p-5q34CGA-57hh-349r-cf4mCGA-59xv-6g2r-pqj8CGA-7mxh-gvv9-jj85CGA-8qc7-gv8x-3mv5CGA-cj3q-6j2x-jvvfCGA-f674-qj48-rcw7CGA-f8pj-h4m5-26cvCGA-g3c9-jrc4-qg64CGA-g7fj-vqcp-wwmpCGA-q5wp-qq83-338hCGA-qj24-h7f6-2hqxCGA-rj3f-42m8-5qf4CGA-rj5c-w59c-76g4CGA-rxwv-p7rv-c7hvCGA-vcv3-xf9j-wgfcCGA-w4f8-cpcj-2x78CGA-wwc7-p4h4-chj8CGA-wwmm-qq8m-76wvCGA-x2j9-c223-6pc3openSUSE-SU-2026:11451-1openSUSE-SU-2026:21643-1CGA-22mx-j43c-8663CGA-2gfx-g85x-xhj5CGA-323q-56pf-34m9CGA-364v-9995-r6pmCGA-448w-4g36-h2qjCGA-46hg-5g9j-5fxrCGA-4f93-3629-f3x6CGA-4fj6-v98r-8p6gCGA-4wfw-xw9w-jhw2CGA-5353-hrfq-f549CGA-5rxp-qmv5-vj3mCGA-63hh-g52x-hgv2CGA-6rf3-2f93-cc4cCGA-72jc-hp5x-f793CGA-74h3-558x-3989CGA-7gp5-qxx4-vmm6CGA-8257-gw39-88r6CGA-82q2-jpj6-qrhpCGA-87cj-jr8h-986vCGA-937m-4vc2-7rwjCGA-9557-8g8w-j8q4CGA-9qcv-7vf6-77mjCGA-c299-4qgc-6gvgCGA-cjcm-jh3h-q98vCGA-f9xf-qpmg-65w2CGA-g634-x9c7-5jh6CGA-gfqv-4gh6-h2wcCGA-h222-mvhr-m3phCGA-h29g-7224-wx2gCGA-j34w-qf3j-pqf4CGA-jpvf-hrxx-xwjxCGA-phxf-rw22-g9vrCGA-pq75-5m5f-r786CGA-q83x-3pg9-r69qCGA-q882-qvcf-593rCGA-q9qj-qg8q-9ggrCGA-qv8x-3j8v-q572CGA-qx44-h2wg-v2f5CGA-rgcg-fprx-wc46CGA-v2hq-8ghg-57rqCGA-v33v-hrg7-47ccCGA-v468-vfpv-6wmwCGA-v594-grmg-m6qgCGA-vgvq-xcp8-7c29CGA-w2cx-3wc6-v9wrCGA-w325-3m2r-p9rfCGA-w3f5-w2gj-3hf7CGA-x272-84w2-j8fvCGA-xjg5-xv94-2q64CGA-pmvp-3pg2-29mwCGA-wmf6-8gqh-pxq6
Published 29-07-2026Last modified 29-07-2026
Vulnerability summary
CVE-2026-13346 is a medium (CVSS 6.5) Absolute Path Traversal vulnerability in pypa pip. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 20.4% of scored vulnerabilities.
CVSS score
6.5/10
010
Medium · v3.1 (NVD)EPSS score
0.29%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 12 · Related 12Timeline
- 29-07-2026PublishedVulnerability first disclosed.
- 29-07-2026Last modifiedVulnerability information updated.
Description
pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.
CVSS metrics
9 scores · 7 sources · 2 versionsMedium 5.6Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:NSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated5.6MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- OSV · WolfiEcosystem advisory · calculated5.6MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated5.6MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- NVDNIST5.6MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Medium 6.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NSourcesAll 4 agree
- OSV · PypiEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
EPSS trend
Probability
0.29%
Chance of exploitation in the next 30 days
Percentile
20%
Versus all other CVEs
30-day change
0.00 pp
From 0.29% on 19-09-2026
19-09-202619-10-2026
EPSS score0.29%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard33 products
- bazel-module-rules_python-1.6.0All versions (No fix recorded)
- datadog-agent-7.76All versions (No fix recorded)
- datadog-agent-7.76-core-integrationsAll versions (No fix recorded)
- datadog-agent-7.77< 7.77.3-r25
- datadog-agent-7.77-core-integrationsAll versions (No fix recorded)
Wolfi12 products
- datadog-agent-7.76All versions (No fix recorded)
- datadog-agent-7.76-core-integrationsAll versions (No fix recorded)
- datadog-agent-7.77< 7.77.3-r25
- datadog-agent-7.77-core-integrationsAll versions (No fix recorded)
- datadog-agent-7.78< 7.78.4-r20
Suse8 products
- python-pip&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP4< 22.3.1-150400.17.29.1
- python-pip&distro=SUSE Linux Enterprise Module for Python 3 15 SP7< 22.3.1-150400.17.29.1
- python-pip&distro=SUSE Linux Enterprise Server 16.0< 25.0.1-160000.6.1
- python-pip&distro=SUSE Linux Enterprise Server for SAP applications 16.0< 25.0.1-160000.6.1
- python3-pip-wheel&distro=SUSE Linux Enterprise Module for Basesystem 15 SP7< 20.0.2-150400.26.1
Opensuse2 products
- python-pip&distro=openSUSE Leap 16.0< 25.0.1-160000.6.1
- python-pip&distro=openSUSE Tumbleweed< 26.2-1.1
Ubuntu2 products
- pipenvAll versions (No fix recorded)
- python-pipAll versions (No fix recorded)
Debian1 product
- python-pipAll versions (No fix recorded)
Pypa1 product
- pip< 26.2
PyPI1 product
- pip< 26.2.0 | < 26.2
Python packaging authority1 product
- pip< 26.2
9 vendors · 61 products
References
21 links- mail.python.org/archives/list/security-announce@python.org/thread/L2BNQGGVQCEV7DROOORQ7WFKKFF2OOQX/Vendor AdvisoryAdvisoryREPORTMailing ListThird Party Advisory
Show all 21 references
- github.com/pypa/pipPACKAGE
- pypi.org/project/pipPACKAGE