HPE NonStop Python 3.x: Directory traversal in TAR archive extraction

Summary

HPE NonStop Python 3.x (T0993) contains a directory traversal vulnerability. Crafted filenames with ".." sequences inside a TAR archive can cause files to be written outside the intended directory, overwriting arbitrary files. The CNA rates the flaw as adjacent-network attack vector with user interaction required, so an attacker would need to deliver a malicious archive that a user or process then extracts.

Affected

• HPE NonStop Python 3.x T0993L01^AAL and earlier (per CNA data; default configuration affected)

Fixed in

Unknown. Check HPE security bulletin HPESBNS05148 rev.1 for the fixed version.

Workaround

Unknown. No vendor workaround found in the sources reviewed.

• Do not extract TAR archives from untrusted or unverified sources with the affected Python.
• Run archive-processing Python processes under a least-privileged account with write access limited to required directories.
• Restrict who can supply archives to these processes.

Exploitation

• No evidence of exploitation found.
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
• Not listed in CISA KEV. No public proof of concept found.

Our recommendation

• If you do not operate HPE NonStop systems, this vulnerability is not applicable.
• If you do, review HPESBNS05148 rev.1 and apply the vendor fix as soon as the fixed version is confirmed.
• Until patched, restrict who can supply archives to Python processes and avoid extracting untrusted TAR files.
• Note that the CNA CVSS 8.0 and Red Hat CVSS 5.5 differ; NVD analysis was pending at the time of writing.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• HPE Security Bulletin HPESBNS05148 support.hpe.com
• Red Hat CVE record access.redhat.com
• OpenCVE app.opencve.io
• Vulners CVE list entry vulners.com
• NVD/Vulners entry vulners.com
• Strix CVE entry www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:18.