CVE-2026-41140

HighCVSS 8.7

Published: 24/04/2026(UTC)Updated: 15/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

21th percentile - higher than 21% of all known CVEs

Summary

A path traversal vulnerability in Poetry before 2.3.4 allows arbitrary file overwrite during sdist tarball extraction. The extractall() function lacks proper path validation on Python 3.10.0-3.10.12 and 3.11.0-3.11.4 where tarfile.data_filter is unavailable.

Risk Assessment

An attacker can place malicious files outside the intended directory, potentially overwriting critical system files or injecting malicious code.

Recommendation

Upgrade Poetry to version 2.3.4 or later immediately. If upgrade is not possible, use a newer Python version (>=3.10.13 or >=3.11.5) that includes tarfile.data_filter.

Other vulnerabilities in Poetry

CVE-2026-34591Medium
Poetry, a dependency manager for Python, from version 1.4.0 to before 2.3.3 allows arbitrary file write via a crafted wheel containing ../ paths. The attack is reachable during normal package install flows.

Original NVD description (English source)

Poetry is a dependency manager for Python. Prior to 2.3.4, the extractall() function in src/poetry/utils/helpers.py:410-426 extracts sdist tarballs without path traversal protection on Python versions where tarfile.data_filter is unavailable. Considering only Python versions which are still supported by Poetry, these are 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4. This vulnerability is fixed in 2.3.4.