CVE-2024-8088

Medium

Published: —Translated: 27/07/2026(UTC)NVD NIST

Summary

A high severity vulnerability in the CPython zipfile module affecting zipfile.Path. When iterating over entry names in a zip archive (e.g., namelist(), iterdir()), unexpected behavior may occur. The more common zipfile.ZipFile class is unaffected.

Risk Assessment

An attacker could exploit this to access data or perform unauthorized file system operations via a crafted zip archive.

Recommendation

Update CPython to a version that fixes zipfile.Path handling, and avoid using this class with untrusted zip archives.

Original NVD description (English source)

There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected. When iterating over names of entries in a zip archive (for example, methods of "zipfile.Path" like "namelist()", "iterdir(