https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-28T15:14:47.913849+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2019-20916 CVE-2019-20916 2026-09-28T15:14:48.311358+00:00

The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.

 https://vulnerability.circl.lu/vuln/ghsa-gpvv-69j7-gwj8 GHSA-gpvv-69j7-gwj8 — Path Traversal in pip 2026-09-28T15:14:48.311546+00:00

Affected: PyPI: pip

The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py. A fix was committed 6704f2ace.

 https://vulnerability.circl.lu/vuln/pysec-2020-173 PYSEC-2020-173 2026-09-28T15:14:48.311619+00:00

Affected: PyPI: pip

The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.