bpo-42988: Remove the pydoc getfile feature (GH-25015)
authorMiss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Mon, 29 Mar 2021 13:08:00 +0000 (06:08 -0700)
committerAndrej Shadura <andrewsh@debian.org>
Tue, 20 Jan 2026 10:45:10 +0000 (11:45 +0100)
commitdb746df22b908684b9f73b4ae6f20a18d1f37786
tree4d422ef7e16ef24f308618aaf220ce44e728af69
parent5536c34d75979fadf392476f99731e8b54bc246d
bpo-42988: Remove the pydoc getfile feature (GH-25015)

CVE-2021-3426: Remove the "getfile" feature of the pydoc module which
could be abused to read arbitrary files on the disk (directory
traversal vulnerability). Moreover, even source code of Python
modules can contain sensitive data like passwords. Vulnerability
reported by David Schwörer.
(cherry picked from commit 9b999479c0022edfc9835a8a1f06e046f3881048)

Co-authored-by: Victor Stinner <vstinner@python.org>
Gbp-Pq: Name 0003-bpo-42988-Remove-the-pydoc-getfile-feature-GH-25015.patch
Lib/pydoc.py
Lib/test/test_pydoc.py