CVE-2026-41140High· 8.7▾ TwilightA flaw was found in Poetry, a dependency manager for Python. This vulnerability allows a remote attacker to perform a path traversal attack. By crafting a malicious software package, the `extractall()` function in Poetry can be tricked int…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.3%
Last analysed / modified upstream
0.3% → 0.5%
— → 8.7
low → high
A flaw was found in Poetry, a dependency manager for Python. This vulnerability allows a remote attacker to perform a path traversal attack. By crafting a malicious software package, the extractall() function in Poetry can be tricked into writing files to unintended locations on the system. This could lead to the creation or overwrite of critical system files, potentially compromising the integrity of the system.
poetry: Poetry: Path traversal vulnerability allows arbitrary file write via malicious package extraction — rated Important by Red Hat. Released 2026-04-24, updated 2026-09-24.
Affected:
Fixed:
No fix planned:
Not affected:
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade https://access.redhat.com/errata/RHSA-2026:24866
Workarounds / mitigations:
Affected packages:
poetry < 2.3.4Patched in:
poetry 2.3.4Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-32274High· 7.5black: Black: Arbitrary file writes from unsanitized user input in cache file name (CVE-2026-32274)
CVE-2026-114140High· 7.8nbconvert: nbconvert: arbitrary file write via path traversal in ExtractOutputPreprocessor (CVE-2026-114140)
CVE-2025-66416High· 8.1mcp: DNS Rebinding Protection Disabled by Default in Model Context Protocol Python SDK (CVE-2025-66416)
CVE-2026-48990Medium· 5.3joserfc: joserfc: Resource exhaustion via oversized JSON Web Signature (JWS) payloads (CVE-2026-48990)
CVE-2020-27534Medium· 5.3moby/buildkit: calls os.OpenFile with a potentially unsafe qemu-check temporary pathname (CVE-2020-27534)
CVE-2026-115877Medium· 5.4twisted: Twisted: HTTP request smuggling via improper header delimiter handling (CVE-2026-115877)