CVE-2019-20916

26

FAUCET Score

CVE-2019-20916 is a directory traversal vulnerability in pip versions prior to 19.2, affecting products like Debian, OpenSUSE, Oracle, and PyPA. It allows an attacker to overwrite arbitrary files, such as /root/.ssh/authorized_keys, by crafting a malicious Content-Disposition header with "../" in the filename when a URL is provided in an install command. This vulnerability is rated as High severity (CVSS 7.5) due to its network-based attack vector, low attack complexity, and high impact on integrity. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		< 19.2CPE matchmatch criteria	cpe:2.3:a:pypa:pip::::::::
		15.1CPE matchmatch criteria	cpe:2.3:o:opensuse:leap:15.1:::::::*
		15.2CPE matchmatch criteria	cpe:2.3:o:opensuse:leap:15.2:::::::*
		9.0CPE matchmatch criteria	cpe:2.3:o:debian:debian_linux:9.0:::::::*
		1.10.0CPE matchmatch criteria	cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:::::::*

CVSS Data

CVSS version used by this source: 3.1

7.5HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

Exploitability Score

3.9

Impact Score

3.6

CvssVersion

3.1

Exploit Intelligence

EPSS Score

3.03%

Probability of exploitation in next 30 days

EPSS Percentile

86.1%

Percentile rank of EPSS score among Peer Group

As of 2026-07-26

Model: v2026.06.15

This CVE's current EPSS score of 0.0303 is in the 75th percentile among its peer group of 51,485 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (30)

github_advisorypatch availablevia nvd_reference

microsoftpatch availablevia msrc

Product: cm1 python-pip 19.2-1 on CBL Mariner 1.0Fixed in: 19.2-1

microsoftpatch availablevia msrc

Product: 17053-16820Fixed in: 19.2-1

oraclepatch availablevia nvd_reference

pippatch availablevia ghsa

Product: pipFixed in: 19.2

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: python-virtualenv-0:15.1.0-7.el7_9

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: python-pip-0:9.0.3-18.el8

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: rh-python36-python-0:3.6.12-1.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: rh-python36-python-pip-0:9.0.1-5.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: rh-python36-python-virtualenv-0:15.1.0-3.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: python27-python-0:2.7.18-2.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: python27-python-pip-0:8.1.2-6.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: python27-python-virtualenv-0:13.1.0-4.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-python36-python-0:3.6.12-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-python36-python-pip-0:9.0.1-5.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-python36-python-virtualenv-0:15.1.0-3.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSFixed in: python27-python-0:2.7.18-2.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSFixed in: python27-python-pip-0:8.1.2-6.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSFixed in: python27-python-virtualenv-0:13.1.0-4.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSFixed in: rh-python36-python-0:3.6.12-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSFixed in: rh-python36-python-pip-0:9.0.1-5.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSFixed in: rh-python36-python-virtualenv-0:15.1.0-3.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUSFixed in: python27-python-0:2.7.18-2.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUSFixed in: python27-python-pip-0:8.1.2-6.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUSFixed in: python27-python-virtualenv-0:13.1.0-4.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUSFixed in: rh-python36-python-0:3.6.12-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUSFixed in: rh-python36-python-pip-0:9.0.1-5.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUSFixed in: rh-python36-python-virtualenv-0:15.1.0-3.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: python27:2.7-8030020200819165638.851f4228

redhatend of lifevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: python-pip

Vendor Advisories (3)

pipGHSA-gpvv-69j7-gwj8high

Path Traversal in pip

microsoft2020-Sep/CVE-2019-20916

The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command because a Content-Disposition header can have ../ in a filename as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.

redhatCVE-2019-20916Moderate

python-pip: directory traversal in _download_http_url() function in src/pip/_internal/download.py

References

lists.opensuse.org / opensuse-security-announce/2020-10/msg00005.html

Mailing ListThird Party Advisory

lists.opensuse.org / opensuse-security-announce/2020-10/msg00010.html

Mailing ListThird Party Advisory

github.com / gzpan123/pip/commit/a4c735b14a62f9cb864533808ac63936704f2ace

Patch

github.com / pypa/pip/compare/19.1.1...19.2

Patch

github.com / pypa/pip/issues/6413

ExploitPatch

lists.debian.org / debian-lts-announce/2020/09/msg00010.html

Mailing ListThird Party Advisory

oracle.com / security-alerts/cpuapr2022.html

PatchThird Party Advisory

oracle.com / security-alerts/cpujul2022.html

PatchThird Party Advisory