---
id: CVE-2026-79824
title: "A directory traversal vulnerability in\_HPE NonStop Python 3.x could allow\_ attackers to overwrite arbitrary files via a ."
summary: "A directory traversal vulnerability in\_HPE NonStop Python 3.x could allow\_ attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive."
severity: high
cvss: 8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-30
  - CWE-22
vendor: Hewlett Packard Enterprise
product: HPE NonStop Python 3.x
affected:
  - hpe_nonstop_python_3.x T0993L01^AAL and earlier
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T10:17:15.483'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-79824'
references:
  - url: >-
      https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbns05148en_us&docLocale=en_US
    label: security-alert@hpe.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-79824.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-79824'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2553131'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-79824'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-79824'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ingestedAt: '2026-10-15T09:59:33.292Z'
scores:
  nvd: 8
  vendor: 7.8
---

## Overview

A directory traversal vulnerability in HPE NonStop Python 3.x could allow  attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux AI (RHEL AI) 3, … · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-79824.json)