GHSA-6w46-j5rx-g56g CVE-2025-71176 PYSEC-2026-1845
pytest has vulnerable tmpdir handling
- Severity
- 6.8 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.15%
- Chance of exploitation in the next 30 days. Higher than 4.48% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-379 Creation of Temporary File in Directory with Insecure Permissions
- Fix
9.0.3- Upgrade pytest to this version or later
Description
pytest through 9.0.2 on UNIX relies on directories with the /tmp/pytest-of-{user} name pattern, which allows local users to cause a denial of service or possibly gain privileges.
Affected versions
PyPI
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
pytest PyPI → 9.0.3
- pip
pip install --upgrade "pytest>=9.0.3"- poetry
poetry add "pytest>=9.0.3"- uv
uv add "pytest>=9.0.3"
Severity breakdown
CVSS 3.1 6.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Changed
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Weakness
CWE-379: Creation of Temporary File in Directory with Insecure Permissions
The product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.
How to prevent it
- Requirements: Many contemporary languages have functions which properly handle this condition. Older C temp file functions are especially susceptible.
- Implementation: Try to store sensitive tempfiles in a directory which is not world readable -- i.e., per-user directories.
- Implementation: Avoid using vulnerable temp file functions.
References
Advisories
Fixes and patches
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-4x5p-f36r-mxxr mlflow Creates of Temporary File in Directory with Insecure Permissions | High | Same weakness, CWE-379 |
| GHSA-wxvp-8q8h-r6rr Moodle Double-Caches Content, Potentially Writing to a File System's Tmp Directory | Medium | Same weakness, CWE-379 |
| GHSA-269q-hmxg-m83q Local Information Disclosure Vulnerability in io.netty:netty-codec-http | Medium | Same weakness, CWE-379 |
| GHSA-p826-8vhq-h439 Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19 | Medium | Same weakness, CWE-379 |
| GHSA-5mcr-gq6c-3hq2 Local Information Disclosure Vulnerability in Netty on Unix-Like systems | Medium | Same weakness, CWE-379 |
Credits: MatheusCylo, adamjstewart
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor