CVE-2023-41105

python: file path truncation at \0 characters

Loading…

Severity

Moderate

Red Hat Product Security

7.5

CVSS 3.1

Review impact separately from score.

Published · August 23, 2023

Updated · November 22, 2025

Description

Python 3.11 os.path.normpath() function is vulnerable to path truncation if a null byte is inserted in the middle of passed path. This may result in bypass of allow lists if implemented before the verification of the path.

Statement

Python versions prior to 3.11.0 are not affected by this flaw.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE-158 · Improper Neutralization of Null Byte or NUL Character