AIKIDO-2026-774047

python is vulnerable to Untrusted Search Path

CVE-2024-3220Published 2 days ago

CVE Score

Low

Untrusted Search Path

TL;DR

On Windows, CPython's mimetypes module loads default Unix-style MIME database paths relative to the current drive's root, where an attacker with write access can plant files that override MIME mappings or exhaust memory during initialization. Patched versions leave mimetypes.knownfiles empty on Windows, retaining built-in mappings and Windows registry mappings without automatically reading these files.

How do I fix this?

Upgrade the python runtime to version 3.11.18, 3.12.16, 3.13.18, 3.14.9, or 3.15.1 or higher within the corresponding release line. The published 3.16.0a1 prerelease is still affected; use a fixed stable release instead. If upgrading is not possible, set mimetypes.knownfiles = [] on Windows immediately after importing mimetypes and before any MIME lookup or initialization, then call mimetypes.init([]). Calling mimetypes.init([]) alone on a fresh initialization still reads the default files in affected versions.

Who does this affect?

You are affected if you run a vulnerable CPython version on Windows, your application initializes mimetypes or calls APIs such as mimetypes.guess_type(), and an attacker can create or modify a default MIME database file on the current drive, such as C:\etc\mime.types. This does not affect the default behavior on Linux or macOS.

Package

python

Versions

1.5a4 - 3.11.17

Fixed in 3.11.18

3.12.0 - 3.12.15

Fixed in 3.12.16

3.13.0 - 3.13.17

Fixed in 3.13.18

3.14.0 - 3.14.8

Fixed in 3.14.9

3.15.0 - 3.15.0

Fixed in 3.15.1

3.16.0a1 - 3.16.0a1

No fix available

Background info

python is vulnerable to Untrusted Search Path in versions 1.5a4 - 3.11.17, 3.12.0 - 3.12.15, 3.13.0 - 3.13.17, 3.14.0 - 3.14.8, 3.15.0 - 3.15.0 and 3.16.0a1 - 3.16.0a1.

CVE Score

Low

Untrusted Search Path

Are you affected? Scan for Free