TI-2024-03759 Aliases CVE-2024-4030 GHSA-2w87-6hh6-mqrj

tempfile.mkdtemp() may be readable and writeable by all users on Windows

LOW 33CWE-276Published 2024-05-07 · Updated 2024-09-07

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

On Windows a directory returned by tempfile.mkdtemp() would not always have permissions set to restrict reading and writing to the temporary directory by other users, instead usually inheriting the correct permissions from the default location. Alternate configurations or users without a profile directory may not have the intended permissions. If you’re not using Windows or haven’t changed the temporary directory location then you aren’t affected by this vulnerability. On other platforms the returned directory is consistently readable and writable only by the current user. This issue was caused by Python not supporting Unix permissions on Windows. The fix adds support for Unix “700” for the mkdir function on Windows which is used by mkdtemp() to ensure the newly created directory has the proper permissions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.003 22nd percentileScored 2026-11-07

Fix Fixed CPython (Python Software Foundation): 3.8.20, 3.9.20, 3.10.15 +3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Python Software Foundation	CPython	before 3.8.20; 3.9.0 to before 3.9.20; 3.10.0 to before 3.10.15; 3.11.0 to before 3.11.10; 3.12.0 to before 3.12.4; 3.13.0a1 to before 3.13.0b1	3.8.20, 3.9.20, 3.10.15, 3.11.10, 3.12.4, 3.13.0b1	Patch available	CNA

CPython VendorPython Software Foundation Affected before 3.8.20; 3.9.0 to before 3.9.20; 3.10.0 to before 3.10.15; 3.11.0 to before 3.11.10; 3.12.0 to before 3.12.4; 3.13.0a1 to before 3.13.0b1 Fixed in 3.8.20, 3.9.20, 3.10.15, 3.11.10, 3.12.4, 3.13.0b1 Patch available CNA

CPE names CISA-ADP · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:python:cpython::::::::	—	—	python-pillow

cpe:2.3:a:python:cpython:*:*:*:*:*:*:*:* Versions — — ·python-pillow

Remediation

Fix · CNA CPython (Python Software Foundation) Fixed in 3.8.20, 3.9.20, 3.10.15, 3.11.10, 3.12.4, 3.13.0b1

Timeline

2026-10-02 Threatist record created from CVE-2024-4030
2026-10-03 Alias added: GHSA-2w87-6hh6-mqrj

References

Patch 12

Advisory 1

https://mail.python.org/archives/list/[email protected]/thread/PRGS5OR3N3PNPT4BMV2VAGN5GMUI5636/

Other 2

TI-2024-07037 Quadratic complexity parsing cookies with backslashes CVSS 3.1HIGH 7.5
TI-2024-11791 Bypass extraction filter to modify file metadata outside extraction directory CVSS 3.1MEDIUM 5.3
TI-2024-00411 Quoted zip-bomb protection for zipfile CVSS 3.1MEDIUM 6.2
TI-2026-13296 `HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching CVSS 4.0MEDIUM 6.0
TI-2024-06422 Email header injection due to unquoted newlines CVSS 3.1MEDIUM 5.5
TI-2026-04606 Possible to hijack modules in current working directory CVSS 4.0MEDIUM 5.6

See all 83 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences