CVE-2019-9948

urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.

CVSS 3.1

9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS

12% chance of exploitation in the next 30 days; higher than 96% of CVEs (scores of 2026-10-25)

CWE

CWE-22

Published

2019-03-23

Modified

2026-10-14

Record from

the NVD, synced 2026-10-19

Affected

• canonical:ubuntu_linux
• debian:debian_linux
• fedoraproject:fedora
• opensuse:leap
• python:python
• redhat:enterprise_linux_desktop
• redhat:enterprise_linux_eus
• redhat:enterprise_linux_server
• redhat:enterprise_linux_server_eus
• redhat:enterprise_linux_tus
• redhat:enterprise_linux_workstation

References

• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html
• http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html
• http://www.securityfocus.com/bid/107549
• https://access.redhat.com/errata/RHSA-2019:1700

Check your stackJSON