CVE-2026-115354: Python Path Traversal Unconfined Os Path Join Open
Unconfined path construction before a file read: a dynamic path segment $COMP is joined onto a base directory with os.path.join() and the result is opened without os.path.realpath() canonicalization and without a containment check. os.path.join() silently discards the base directory when $COMP is absolute, and os.path.normpath() only collapses ".." segments
Pythongreprules fetch cve-2026-115354-python-path-traversal-unconfined-os-path-join-open --engine opengrepDescription
Unconfined path construction before a file read: a dynamic path segment $COMP is joined onto a base directory with os.path.join() and the result is opened without os.path.realpath() canonicalization and without a containment check. os.path.join() silently discards the base directory when $COMP is absolute, and os.path.normpath() only collapses ".." segments
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.