Path Traversal Vulnerability in Poetry Dependency Manager for Python
CVE-2026-41140

0.6LOW

Key Information:

Vendor

Python-poetry

Status
Poetry
Vendor
CVE Published:
24 April 2026

What is CVE-2026-41140?

The Poetry dependency manager for Python has a vulnerability in its extractall() function, allowing path traversal when extracting source distribution (sdist) tarballs. This issue affects versions prior to 2.3.4, specifically targeting supported Python versions 3.10.0 through 3.10.12 and 3.11.0 through 3.11.4. The lack of path traversal protection means that attackers could exploit this vulnerability to gain unauthorized access to sensitive files during the extraction process. The issue has been addressed and fixed in version 2.3.4 of Poetry.

Affected Version(s)

poetry < 2.3.4

References

https://github.com/python-poetry/poetry/security/advisori...
x_refsource_CONFIRM

CVSS V4

Score:
0.6
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.