pypa virtualenv up to 21.14.8 Uninstall Dist top_level.txt PipInstall._uninstall_previous_version path traversal

Summaryinfo

A vulnerability described as problematic has been identified in pypa virtualenv up to 21.14.8. This affects the function PipInstall._uninstall_previous_version of the file top_level.txt of the component Uninstall Dist. Executing a manipulation can lead to path traversal. This vulnerability is registered as CVE-2026-113719. The attack needs to be launched locally. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in pypa virtualenv up to 21.14.8. It has been declared as problematic. This vulnerability affects the function PipInstall._uninstall_previous_version of the file top_level.txt of the component Uninstall Dist. The manipulation with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect integrity, and availability. CVE summarizes:

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall._uninstall_previous_version() accepts existing seed-package metadata and _uninstall_dist() joins entries from top_level.txt and RECORD to site-packages without checking containment. When a reused destination contains distribution metadata influenced by another account, relative traversal, absolute entries, or linked parents can cause app-data reseeding to delete files outside the environment or the environment root with the invoking user's permissions, provided that user has deletion rights over the named paths. The deletion occurs during environment creation before any later use of the environment. Fresh environments without existing package metadata and creation with --clear do not enter this cleanup path. This issue is fixed in version 21.14.9.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-113719 since 10/20/2026. The exploitation appears to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1006.

By approaching the search of inurl:top_level.txt it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 21.14.9 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• pypa

Name

• virtualenv

Version

• 21.14.0
• 21.14.1
• 21.14.2
• 21.14.3
• 21.14.4
• 21.14.5
• 21.14.6
• 21.14.7
• 21.14.8

Website

• Product: https://github.com/pypa/virtualenv/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion