CVE-2026-12345

A flaw was found in Python. A race condition during the cleanup of temporary directories allows a local attacker with write access to replace a directory with a symbolic link (a reference pointing to another location). This can lead to unauthorized deletion or alteration of files outside the temporary directory, performed with the privileges of the process executing the cleanup.

This vulnerability is rated as Moderate severity rather than Important because successful exploitation requires local system access, existing permissions to manipulate the target directory structure, and winning a narrow timing window during deletion. In Red Hat Enterprise Linux environments, standard temporary directory creation restricts access to the executing user, significantly limiting exposure to unprivileged local attackers. Applications running with elevated privileges that operate on shared or world-writable directories are at risk of unintended target file removal or permission tampering.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, ensure kernel symlink protection is enabled (active by default in RHEL) by verifying sysctl fs.protected_symlinks is set to 1. Additionally, restrict exposure on shared systems by setting the TMPDIR environment variable to a secure, user-private directory rather than a public shared path (e.g., export TMPDIR=/path/to/private_tmp).