DEBIAN-CVE-2026-1703
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-1703
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-1703.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-1703
- Upstream
- Published
- 2026-02-02T15:16:30.510Z
- Modified
- 2026-02-03T11:16:22.145715Z
- Severity
-
- 2.0 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
- Summary
- [none]
- Details
-
When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations.
- References
Affected packages
Debian:11 / python-pip
Package
- Name
- python-pip
- Purl
- pkg:deb/debian/python-pip?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affected
Affected versions
20.*
20.3.4-4
20.3.4-4+deb11u1
20.3.4-4+deb11u2
21.*
21.3.1+dfsg-1
21.3.1+dfsg-2
21.3.1+dfsg-3
22.*
22.0.2+dfsg-1
22.1+dfsg-1
22.1.1+dfsg-1
22.2+dfsg-1
22.3+dfsg-1
22.3.1+dfsg-1
22.3.1+dfsg-2
23.*
23.0+dfsg-1
23.0+dfsg-2
23.0.1+dfsg-1
23.1.2+dfsg-1
23.1.2+dfsg-2
23.2+dfsg-1
23.2.1+dfsg-1
23.3+dfsg-1
24.*
24.0+dfsg-1
24.0+dfsg-2
24.1+dfsg-1
24.1.1+dfsg-1
24.2+dfsg-1
24.3.1+dfsg-1
25.*
25.0+dfsg-1
25.0.1+dfsg-1
25.1+dfsg-1
25.1.1+dfsg-1
25.2+dfsg-1
25.3+dfsg-1
Debian:12 / python-pip
Package
- Name
- python-pip
- Purl
- pkg:deb/debian/python-pip?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affected
Debian:13 / python-pip
Package
- Name
- python-pip
- Purl
- pkg:deb/debian/python-pip?arch=source
Debian:14 / python-pip
Package
- Name
- python-pip
- Purl
- pkg:deb/debian/python-pip?arch=source