CVE-2026-48681: Python Insecure File Url Path Validation

Extracting a file path from a user-supplied URL and verifying only its existence allows path traversal and arbitrary local file reads. Path input extracted from untrusted URLs must be defensively normalized using `os.path.abspath` and verified against an explicit allowlist before being trusted.

Provally CuratedPublic repositoryMediumMedium confidenceVerifiedApache-2.0Python
greprules fetch cve-2026-48681-python-insecure-file-url-path-validation --engine opengrep

Description

Extracting a file path from a user-supplied URL and verifying only its existence allows path traversal and arbitrary local file reads. Path input extracted from untrusted URLs must be defensively normalized using `os.path.abspath` and verified against an explicit allowlist before being trusted.