CVE-2026-3479 — pkgutil.get_data() does not enforce documented restrictions
DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated t…
Published: 2026-03-18 · CVSS: 0.0 · CVSS 4.0
DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if following the intended security model. pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7