VULNERABILITY INTELLIGENCE
CVE-2026-3479
EPSS probability0.25%
CISA KEVNot currently listed
Published2026-03-18
Last modified2026-06-17
Description
DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if following the intended security model. pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.
Weakness classification
- 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-22