CPython EUVD-2026-89183

Requires local ability to modify the directory tree while it is being removed by tempfile.TemporaryDirectory cleanup (which calls shutil.rmtree). The attacker must win a race to replace a directory with a symbolic link during cleanup, and the damage occurs with the privileges of the process performing the cleanup - so the meaningful case is a higher-privileged process cleaning a tree a lower-privileged attacker can write into. Symlink-driven deletion of files outside the tree is limited to platforms where shutil.rmtree.avoids_symlink_attacks is false; however, resetting of file flags outside the tree can occur on all platforms. Limiting factors: local access only (no remote vector), a race window that must be won (AT:P / AC:H), and no impact against configurations where the cleanup process holds no more privilege than the attacker.

The provided CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H) scores 5.9 (medium) and is internally coherent with the description: exploitation is local (AV:L), requires no privileges or user interaction, but carries an Attack Requirement (AT:P) reflecting the TOCTOU race window that must be won, and delivers high integrity and availability impact (arbitrary file deletion / permission and flag resets) with zero confidentiality impact (VC:N). There is no EPSS score, no CISA KEV listing, and no public exploit code referenced, so this is 'no public exploit identified at time of analysis' - the only exploitation evidence is the vendor's own bug report and fix. The signals are consistent (medium severity, local vector, race-gated), so this is a genuine but bounded defense-in-depth issue rather than a mass-exploitation priority: real risk concentrates on systems where a higher-privileged process (e.g. root or a service) cleans up a temporary tree that a lower-privileged local user can also modify. Two data conflicts should be flagged: the CWE is listed as N/A even though the description unambiguously describes a symlink-following TOCTOU race (CWE-59 / CWE-367), and the 'Information Disclosure' tag contradicts the CVSS vector, which sets VC:N - the actual impact is integrity and availability, not disclosure. The PR:N choice is also debatable: the attacker must already be able to write into the tree during cleanup, which in practice implies some local foothold.

A privileged process (for example a root-owned service or a setuid tool) uses tempfile.TemporaryDirectory, and a local unprivileged attacker who can write into that tree waits for cleanup to begin. During the removal, the attacker replaces a subdirectory with a symbolic link pointing outside the tree, so shutil.rmtree follows it and deletes or resets permissions/flags on files owned by the privileged process. No public exploit code is referenced; success depends on winning the cleanup race (AT:P), and platforms where shutil.rmtree.avoids_symlink_attacks is false are most exposed, though file-flag resets can occur on all platforms.