CVE-2026-114094: Python Path Validator Missing Dos Drive Prefix Checkcve-2026-114094-python-path-validator-missing-dos-drive-prefix-check
Path $PATH is validated element-by-element after splitting on a path separator, or it is guarded only against leading "/" or "\\" absolute forms before being joined under a filesystem root, and the whole path is never checked for a DOS drive-letter prefix. On Windows, os.path.join(root, "C:/x") discards "root", so a hostile repository/archive entry named "C:
