{"id":"CVE-2026-41140","title":"poetry: Poetry: Path traversal vulnerability allows arbitrary file write via malicious package extraction (CVE-2026-41140)","summary":"A flaw was found in Poetry, a dependency manager for Python. This vulnerability allows a remote attacker to perform a path traversal attack. By crafting a malicious software package, the `extractall()` function in Poetry can be tricked int…","severity":"high","cvss":8.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","cvssSource":"vendor","cwe":"CWE-22","vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6","affected":["ansible_automation_platform 2","ansible_automation_platform 2.6"],"patched":["ansible_automation_platform 2.6"],"published":"2026-04-24","updated":"2026-09-24","sourceUpdated":"2026-09-24T14:27:16+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41140.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41140.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-41140"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461604"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41140"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41140"},{"url":"https://github.com/python-poetry/poetry/security/advisories/GHSA-73h3-mf4w-8647"},{"url":"https://access.redhat.com/errata/RHSA-2026:24866"},{"url":"https://github.com/python-poetry/poetry"},{"url":"https://github.com/python-poetry/poetry/releases/tag/2.3.4"}],"tags":["csaf","vex","red-hat","osv","pip"],"epss":0.00294,"epssPercentile":0.2186,"aliases":["GHSA-73h3-mf4w-8647","PYSEC-2026-2890"],"ecosystem":"pip","ingestedAt":"2026-07-13T18:57:54.078Z","slug":"CVE-2026-41140","body":"## Overview\n\nA flaw was found in Poetry, a dependency manager for Python. This vulnerability allows a remote attacker to perform a path traversal attack. By crafting a malicious software package, the `extractall()` function in Poetry can be tricked into writing files to unintended locations on the system. This could lead to the creation or overwrite of critical system files, potentially compromising the integrity of the system.\n\n## Vendor advisories\n\n- **RHSA-2026:24866** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-06-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:24866)\n- **Red Hat VEX** · Important · affected: Red Hat Ansible Automation Platform 2 · no fix planned: Red Hat Ansible Automation Platform 2 · updated 2026-09-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41140.json)\n\n**poetry: Poetry: Path traversal vulnerability allows arbitrary file write via malicious package extraction** — rated Important by Red Hat. Released 2026-04-24, updated 2026-09-24.\n\nAffected:\n\n- Red Hat Ansible Automation Platform 2\n\nFixed:\n\n- Red Hat Ansible Automation Platform 2.6\n\nNo fix planned:\n\n- Red Hat Ansible Automation Platform 2\n\nNot affected:\n\n- Red Hat Ansible Automation Platform 2.6\n- Red Hat Ansible Automation Platform 2\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat Satellite 6\n\n## Remediation\n\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade https://access.redhat.com/errata/RHSA-2026:24866\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\n## Package advisory (CVE-2026-41140)\n\nAffected packages:\n\n- `poetry < 2.3.4`\n\nPatched in:\n\n- `poetry 2.3.4`\n\nSource: https://osv.dev/vulnerability/GHSA-73h3-mf4w-8647","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":47.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":210689,"id":"CVE-2026-41140","ts":1790322194372,"field":"cvss","old":null,"new":"8.7"},{"seq":210688,"id":"CVE-2026-41140","ts":1790322194372,"field":"severity","old":"low","new":"high"}]}