--- title: Python Software Foundation - Python 3.11.0a3 to 3.15.0b2 description: Bishop Fox disclosed CVE-2026-12003, an uncontrolled search path vulnerability (CWE-427) affecting Windows installations of Python from version 3.11.0a3... canonical: https://daily.dev/posts/python-software-foundation---python-3-11-0a3-to-3-15-0b2-vznle4ihs twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Python Software Foundation - Python 3.11.0a3 to 3.15.0b2 | daily.dev og:description: Bishop Fox disclosed CVE-2026-12003, an uncontrolled search path vulnerability (CWE-427) affecting Windows installations of Python from version 3.11.0a3... og:url: https://daily.dev/posts/python-software-foundation---python-3-11-0a3-to-3-15-0b2-vznle4ihs og:image: https://api.daily.dev/og/posts/VznlE4iHs.png og:image:alt: Python Software Foundation - Python 3.11.0a3 to 3.15.0b2 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Python Software Foundation - Python 3.11.0a3 to 3.15.0b2 **[Sliver C2 Documentation](https://daily.dev/sources/bishopfox)** · 14 min read · 0 upvotes · 0 comments ## Summary Bishop Fox disclosed CVE-2026-12003, an uncontrolled search path vulnerability (CWE-427) affecting Windows installations of Python from version 3.11.0a3 through 3.15.0b2. The flaw allowed low-privilege users on systems with default all-users installations to plant malicious files two directories above the Python installation path, hijacking execution when a privileged user or service later launched the Python interpreter, enabling arbitrary code execution and full privilege escalation, including creating new administrator accounts. The root cause traces to a hardcoded VPATH value introduced in a December 2021 CPython commit that was later made into a build-time variable but retained the exploitable path-traversal string. Patches are available in Python 3.13.15, 3.14.7, and 3.15.0b3+, with a fix for 3.12 merged but not yet released and a 3.11 fix still pending merge. Bishop Fox recommends discontinuing shared/system-wide installs in favor of per-user installations or upgrading to patched versions. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-12003 and how does it let a low-privilege user escalate privileges on Windows? CVE-2026-12003 is an uncontrolled search path vulnerability (CWE-427) in Windows builds of Python 3.11.0a3 through 3.15.0b2. A hardcoded VPATH value causes the interpreter to look for standard library files two directories above the installation path (e.g. resolving to C:\ for a default all-users install), letting a low-privilege user plant malicious files there and hijack code executed by any privileged account that later runs Python. _Track Windows Python security advisories like this one on daily.dev before they hit production systems._ ### Which Python versions fix the VPATH Windows privilege escalation vulnerability? Python 3.13.15 and 3.14.7 both include the fix and are available for download, and 3.15.0b3 and later pre-releases also contain the patch. A fix for 3.12 was merged into the still-unreleased 3.12.14 (a source-only release), while the fix for 3.11 exists only as an unmerged pull request (GH-151568), leaving no patched 3.11 release at disclosure time. _Check patched versions before upgrading Python fleets on daily.dev to avoid shipping a still-vulnerable build._ ### How can I mitigate the Python Windows VPATH path traversal vulnerability without upgrading? Two workarounds exist: create a ._pth file in the same directory as python.exe, which forces path construction from that file's contents instead of the vulnerable VPATH logic, or set a PYTHONHOME environment variable, which causes the getpath module to unset the stdlib_dir variable. Official embedded Windows Python builds already use ._pth files and were not vulnerable. Both workarounds can alter interpreter behavior beyond path construction. _Compare mitigation trade-offs for unpatched Python installs on daily.dev before choosing a workaround._ ## Similar posts on daily.dev - [Python 3.12.14, 3.11.16 and 3.10.21 are now available\!](https://daily.dev/posts/python-3-12-14-3-11-16-and-3-10-21-are-now-available--8j1vyqar6) · Python Insider · 1 upvotes · 0 comments - [Python 3.15’s interpreter for Windows x86-64 should hopefully be 15% faster](https://daily.dev/posts/python-3-15-s-interpreter-for-windows-x86-64-should-hopefully-be-15-faster-jr6vhuaba) · Hacker News · 9 upvotes · 0 comments - [Python 3.15.0a8, 3.14.4 and 3.13.13 are out\!](https://daily.dev/posts/python-3-15-0a8-3-14-4-and-3-13-13-are-out--fpknzjqcr) · Python Insider · 29 upvotes · 1 comments --- Tags: [#security](https://daily.dev/tags/security), [#python](https://daily.dev/tags/python), [#windows](https://daily.dev/tags/windows), [#vulnerability](https://daily.dev/tags/vulnerability) [View this post on daily.dev](https://daily.dev/posts/python-software-foundation---python-3-11-0a3-to-3-15-0b2-vznle4ihs) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Python Software Foundation - Python 3.11.0a3 to 3.15.0b2","url":"https://daily.dev/posts/python-software-foundation---python-3-11-0a3-to-3-15-0b2-vznle4ihs","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/python-software-foundation---python-3-11-0a3-to-3-15-0b2-vznle4ihs"},"datePublished":"2026-08-23T12:19:04.363Z","dateModified":"2026-08-23T12:31:02.218Z","description":"Bishop Fox disclosed CVE-2026-12003, an uncontrolled search path vulnerability (CWE-427) affecting Windows installations of Python from version 3.11.0a3...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/dd048316927b934a9c4ded63f8cba1cf?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/dd048316927b934a9c4ded63f8cba1cf?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Sliver C2 Documentation","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Sliver C2 Documentation","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/bishopfox"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/python-software-foundation---python-3-11-0a3-to-3-15-0b2-vznle4ihs","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,python,windows,vulnerability","timeRequired":"PT14M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Sliver C2 Documentation","item":"https://daily.dev/sources/bishopfox"},{"@type":"ListItem","position":3,"name":"Python Software Foundation - Python 3.11.0a3 to 3.15.0b2"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/python-software-foundation---python-3-11-0a3-to-3-15-0b2-vznle4ihs#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-12003 and how does it let a low-privilege user escalate privileges on Windows?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-12003 is an uncontrolled search path vulnerability (CWE-427) in Windows builds of Python 3.11.0a3 through 3.15.0b2. A hardcoded VPATH value causes the interpreter to look for standard library files two directories above the installation path (e.g. resolving to C:\\ for a default all-users install), letting a low-privilege user plant malicious files there and hijack code executed by any privileged account that later runs Python. Track Windows Python security advisories like this one on daily.dev before they hit production systems."}},{"@type":"Question","name":"Which Python versions fix the VPATH Windows privilege escalation vulnerability?","acceptedAnswer":{"@type":"Answer","text":"Python 3.13.15 and 3.14.7 both include the fix and are available for download, and 3.15.0b3 and later pre-releases also contain the patch. A fix for 3.12 was merged into the still-unreleased 3.12.14 (a source-only release), while the fix for 3.11 exists only as an unmerged pull request (GH-151568), leaving no patched 3.11 release at disclosure time. Check patched versions before upgrading Python fleets on daily.dev to avoid shipping a still-vulnerable build."}},{"@type":"Question","name":"How can I mitigate the Python Windows VPATH path traversal vulnerability without upgrading?","acceptedAnswer":{"@type":"Answer","text":"Two workarounds exist: create a ._pth file in the same directory as python.exe, which forces path construction from that file's contents instead of the vulnerable VPATH logic, or set a PYTHONHOME environment variable, which causes the getpath module to unset the stdlib_dir variable. Official embedded Windows Python builds already use ._pth files and were not vulnerable. Both workarounds can alter interpreter behavior beyond path construction. Compare mitigation trade-offs for unpatched Python installs on daily.dev before choosing a workaround."}}]} ```