CVE-2026-28795: Python Unvalidated File Format Path Traversalcve-2026-28795-python-unvalidated-file-format-path-traversal
A function parameter is interpolated as a file extension into a filename f-string and then used to open or path-join a file, without first validating the parameter against an allowlist of permitted formats. Attackers can supply values such as "../../etc/cron.d/x" or dangerous extensions (".py", ".sh", ".php") to traverse outside the intended directory or wri
