---
id: CVE-2026-1703
aliases:
  - GHSA-6vgw-5pg2-w6jp
  - PYSEC-2026-1796
title: pip Path Traversal vulnerability
summary: pip Path Traversal vulnerability
severity: low
vendor: pip
product: pip
ecosystem: pip
affected:
  - pip < 26.0
patched:
  - pip 26.0
published: '2026-02-02'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:34.266257578Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-6vgw-5pg2-w6jp'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-1703'
  - url: 'https://github.com/pypa/pip/pull/13777'
  - url: >-
      https://github.com/pypa/pip/commit/8e227a9be4faa9594e05d02ca05a413a2a4e7735
  - url: 'https://github.com/pypa/pip'
  - url: >-
      https://mail.python.org/archives/list/security-announce@python.org/thread/WIEA34D4TABF2UNQJAOMXKCICSPBE2DJ
tags:
  - osv
  - pip
epss: 0.00414
epssPercentile: 0.3297
ingestedAt: '2026-07-08T18:25:46.534Z'
---

## Overview

When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations.

## Affected packages

- `pip < 26.0`

## Remediation

Upgrade to a patched release:

- `pip 26.0`