FlawAtlas
Search the atlas
CVE-2019-9948 Critical

CVE-2019-9948

urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.

Exploit probability 11.8%
Published March 23, 2019
Required by Not available
Last source change August 7, 2026

02 / AFFECTED SOFTWARE

Affected packages

Unknown Unknown

145 explicit affected versions

Unknown Unknown

257 explicit affected versions

03 / CONNECTIONS

Connected vulnerabilities

04 / EVIDENCE

Source records

Open Source Vulnerabilities PSF-2019-12

urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.

View original source
Open Source Vulnerabilities CVE-2019-9948

urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.

View original source

05 / REFERENCES

Further evidence