CVE-2025-71176
MEDIUMpytest < 9.0.3 - Denial of Service via Insecure Temporary Directory Permissions
Title source: llmDescription
pytest through 9.0.2 on UNIX relies on directories with the /tmp/pytest-of-{user} name pattern, which allows local users to cause a denial of service or possibly gain privileges.
References (2)
Core 2
Core References
Issue Tracking
https://github.com/pytest-dev/pytest/issues/13669
Scores
CVSS v3
6.8
EPSS
0.0001
EPSS Percentile
1.0%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-379
Status
published
Products (1)
pypi/pytest
0 - 9.0.3PyPI
Published
Jan 22, 2026
Tracked Since
Feb 18, 2026