CVE-2019-20916 is a high-severity (CVSS 7.5) Path Traversal vulnerability in pip. 1 public exploit reference exists, so weaponization risk is real. A fix is available for pip — see the affected versions and patch details below.
Path Traversal in pip
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2019-20916 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 385,738 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
pipReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.
Description
The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py. A fix was committed 6704f2ace.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐍PyPI | pip | all versions | 19.2pip install --upgrade 'pip==19.2' |
Affected Products
debian linuxdebianleapopensusecommunications cloud native core network function cloud native environmentoraclecommunications cloud native core policyoraclepippypaResearch use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for pip, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update pip to 19.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2019-20916 is resolved across your whole dependency graph.
Workarounds
Resolve every user-supplied path to its canonical form and reject anything that escapes the intended directory, and run the component under an account that has no read or write access outside the directory it legitimately serves.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
This issue has been rated as having Moderate impact because of the preconditions needed to trigger the flaw: it only affects Python Wheels and requires the user to pip-install a wheel from a malicious server. Installing software from untrusted servers is insecure by definition and strongly discouraged, as it may lead…
Avoid downloading or installing packages from potentially malicious servers via the command-line "pip download" or "pip install".Source: Red Hat security advisory for CVE-2019-20916 (CC BY 4.0)
| Product | Fixed in | Advisory |
|---|---|---|
| Red Hat Enterprise Linux 7 | python-virtualenv-0:15.1.0-7.el7_9 | RHSA-2022:5234 |
| Red Hat Enterprise Linux 8 | python-pip-0:9.0.3-18.el8 | RHSA-2020:4432 |
| Red Hat Enterprise Linux 8 | python27:2.7-8030020200819165638.851f4228 | RHSA-2020:4654 |
| Red Hat Software Collections for Red Hat Enterprise Linux 6 | rh-python36-python-0:3.6.12-1.el6 | RHSA-2020:4285 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | python27-python-0:2.7.18-2.el7 | RHSA-2020:4273 |
Frequently Asked Questions
Is CVE-2019-20916 in your dependencies?
Find it across PyPI, including transitive dependencies.