CVE-2026-79824 PUBLISHED

HPE NonStop Python 3.x - Directory traversal vulnerability

Assigner: hpe
Reserved: 25.08.2026 Published: 15.10.2026 Updated: 15.10.2026

A directory traversal vulnerability in HPE NonStop Python 3.x could allow attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS Score: 8

Attack Vector	Adjacent Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	High
User Interaction	Required	Availability Impact	High

CVSS 3.1

Product Status

Vendor	Hewlett Packard Enterprise
Product	HPE NonStop Python 3.x
Versions	Default: affected Version T0993L01^AAL and earlier is affected

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbns05148en_us&docLocale=en_US

Problem Types

CWE-30 Path traversal: '\dir\..\filename' CWE

Impacts

CAPEC-165 File Manipulation