---
id: CVE-2020-15141
aliases:
  - GHSA-7wgr-7666-7pwj
  - PYSEC-2020-70
title: Path Traversal in openapi-python-client
summary: Path Traversal in openapi-python-client
severity: low
cvss: 3
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N'
vendor: openapi-python-client
product: openapi-python-client
ecosystem: pip
affected:
  - openapi-python-client < 0.5.3
patched:
  - openapi-python-client 0.5.3
published: '2020-08-20'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:48:30.732585870Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-7wgr-7666-7pwj'
references:
  - url: >-
      https://github.com/triaxtec/openapi-python-client/security/advisories/GHSA-7wgr-7666-7pwj
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2020-15141'
  - url: >-
      https://github.com/triaxtec/openapi-python-client/commit/3e7dfae5d0b3685abf1ede1bc6c086a116ac4746
  - url: 'https://github.com/openapi-generators/openapi-python-client'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/openapi-python-client/PYSEC-2020-70.yaml
  - url: >-
      https://github.com/triaxtec/openapi-python-client/blob/main/CHANGELOG.md#053---2020-08-13
  - url: 'https://pypi.org/project/openapi-python-client'
tags:
  - osv
  - pip
epss: 0.01137
epssPercentile: 0.65106
ingestedAt: '2026-09-12T03:13:01.673Z'
---

## Overview

### Impact
Path traversal vulnerability. If a user generated a client using a maliciously crafted OpenAPI document, it is possible for generated files to be placed in arbitrary locations on disk.

Giving this a CVSS score of 3.0 (Low) with CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N/E:P/RL:U/RC:C

### Patches
A fix is being worked on for version 0.5.3

### Workarounds
Inspect OpenAPI documents before generating clients for them.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [openapi-python-client](https://github.com/triaxtec/openapi-python-client/issues)
* Email us at [danthony@triaxtec.com](mailto:danthony@triaxtec.com)

## Affected packages

- `openapi-python-client < 0.5.3`

## Remediation

Upgrade to a patched release:

- `openapi-python-client 0.5.3`