tmpdir: prevent symlink attacks and TOCTOU races (CVE-2025-71176) by laurac8r · Pull Request #14279 · pytest-dev/pytest

laurac8r · 2026-03-09T04:56:14Z

Open the base temporary directory using os.open with O_NOFOLLOW and O_DIRECTORY flags to prevent symlink attacks. Use the resulting file descriptor for fstat and fchmod operations to eliminate Time-of-Check Time-of-Use (TOCTOU) races.

closes #13669

Include documentation when adding new features.
Include new tests or update existing tests when applicable.
Allow maintainers to push and squash when merging my commits. Please uncheck this if you prefer to squash the commits yourself.

If this change fixes an issue, please:

Add text like closes #XYZW to the PR description and/or commits (where XYZW is the issue number). See the github docs for more information.

Important

Unsupervised agentic contributions are not accepted. See our AI/LLM-Assisted Contributions Policy.

If AI agents were used, they are credited in Co-authored-by commit trailers.

Unless your change is trivial or a small documentation fix (e.g., a typo or reword of a small section) please:

Create a new changelog file in the changelog directory, with a name like <ISSUE NUMBER>.<TYPE>.rst. See changelog/README.rst for details.

Write sentences in the past or present tense, examples:
- Improved verbose diff output with sequences.
- Terminal summary statistics now use multiple colors.
Also make sure to end the sentence with a ..
Add yourself to AUTHORS in alphabetical order.

Open the base temporary directory using `os.open` with `O_NOFOLLOW` and `O_DIRECTORY` flags to prevent symlink attacks. Use the resulting file descriptor for `fstat` and `fchmod` operations to eliminate Time-of-Check Time-of-Use (TOCTOU) races. Co-authored-by: Windsurf, Gemini

Co-authored-by: Windsurf, Gemini

Co-authored-by Windsurf

Co-authored-by Windsurf, Gemini

for more information, see https://pre-commit.ci

Co-authored-by: Windsurf

for more information, see https://pre-commit.ci

Co-authored-by: Windsurf

webknjaz · 2026-03-09T13:51:43Z

changelog/13669.bugfix.rst

@@ -0,0 +1,3 @@
+Fixed a symlink attack vulnerability (CVE-2025-71176) in the :fixture:`tmp_path` fixture's base directory handling.
+
+The ``pytest-of-<user>`` directory under the system temp root is now opened with ``O_NOFOLLOW`` and verified using file-descriptor-based ``fstat``/``fchmod``, preventing symlink attacks and TOCTOU races.


Mind linking this abbrebiation to the definition?

webknjaz · 2026-03-09T13:52:33Z

testing/test_tmpdir.py

+
+    # Figure out what rootdir name pytest would use, then replace it
+    # with a symlink pointing to the attacker-controlled directory.
+    import getpass


Why is the import happening inside a function?

webknjaz · 2026-03-09T13:53:22Z

testing/test_tmpdir.py

+) -> None:
+    """Cover the branch where basetemp is set but the directory no longer
+    exists when pytest_sessionfinish runs (314->320 partial branch)."""
+    from _pytest.tmpdir import pytest_sessionfinish


Misplaced imports are normally discouraged. Any justification?

webknjaz · 2026-03-09T13:55:45Z

changelog/13669.bugfix.rst

@@ -0,0 +1,3 @@
+Fixed a symlink attack vulnerability (CVE-2025-71176) in the :fixture:`tmp_path` fixture's base directory handling.


There's a :cve: role that the sphinx-issues extension provides. Plus, feel free to take the credit:

Suggested change

Fixed a symlink attack vulnerability (CVE-2025-71176) in the :fixture:`tmp_path` fixture's base directory handling.

Fixed a symlink attack vulnerability (:cve:`2025-71176`) in the :fixture:`tmp_path` fixture's base directory handling -- by :user:`laurac8r`.

webknjaz · 2026-03-09T13:58:17Z

changelog/13669.bugfix.rst

It'd be useful to symlink 14279.bugfix.rst to 13669.bugfix.rst so that both are linked @ https://pytest--14279.org.readthedocs.build/en/14279/changelog.html#bug-fixes (you can also use this link to preview the change note render after pushing updates to this PR).

webknjaz · 2026-03-09T14:00:13Z

src/_pytest/tmpdir.py

Some of this should probably go under a @contextlib.contextmanager for maintainability.

webknjaz · 2026-03-09T14:02:30Z

testing/test_tmpdir.py

    assert (basetemp.parent.stat().st_mode & 0o077) == 0
+
+
+@pytest.mark.skipif(not hasattr(os, "getuid"), reason="checks unix permissions")


You can assign this to a variable and then reuse it in all these tests like so:

skip_if_no_getuid = pytest.mark.skipif(not hasattr(os, "getuid"), reason="checks unix permissions")

Suggested change

@pytest.mark.skipif(not hasattr(os, "getuid"), reason="checks unix permissions")

@skip_if_no_getuid

webknjaz · 2026-03-09T14:03:49Z

testing/test_tmpdir.py

+    tmp_path: Path,
+) -> None:
+    """Cover the branch where basetemp is set but the directory no longer
+    exists when pytest_sessionfinish runs (314->320 partial branch)."""


These line numbers will become wrong over time.

webknjaz · 2026-03-09T14:04:06Z

testing/test_tmpdir.py

+
+    # exitstatus=0 + policy="failed" + _given_basetemp=None enters the
+    # cleanup block; basetemp.is_dir() is False so rmtree is skipped.
+    pytest_sessionfinish(FakeSession, exitstatus=0)


Feels like this should be isolated, no?

orlitzky · 2026-03-09T15:25:48Z

This certainly looks like an improvement, but it's still possible for any user to DoS the machine until a reboot with for x in $(cat /etc/passwd | cut -f1 -d:); do touch /tmp/pytest-of-$x; done;.

Laura Kaminskiy added 3 commits March 9, 2026 00:49

docs: added a bugfix changelog entry

ec18caa

Co-authored-by: Windsurf, Gemini

chore: added name to AUTHORS file

b3cb812

psf-chronographer bot added the bot:chronographer:provided (automation) changelog entry is part of PR label Mar 9, 2026

Laura Kaminskiy and others added 9 commits March 9, 2026 01:04

chore: adding test coverage

5894e25

Co-authored-by Windsurf

chore: Add tests for tmp_path retention configuration validation

7f93f0a

Co-authored-by Windsurf, Gemini

[pre-commit.ci] auto fixes from pre-commit.com hooks

e232f12

for more information, see https://pre-commit.ci

chore: improve coide coverage for edge case

fe0832b

Co-authored-by: Windsurf

Merge remote-tracking branch 'origin/hotfix/cve' into hotfix/cve

23000e8

Merge branch 'pytest-dev:main' into hotfix/cve

09bd0ed

[pre-commit.ci] auto fixes from pre-commit.com hooks

068fd4e

for more information, see https://pre-commit.ci

chore: remove dead code

a724939

Co-authored-by: Windsurf

Merge branch 'pytest-dev:main' into hotfix/cve

9a4451a

laurac8r mentioned this pull request Mar 9, 2026

Vulnerable tmpdir handling (CVE-2025-71176) #13669

Open

webknjaz reviewed Mar 9, 2026

View reviewed changes

src/_pytest/tmpdir.py

Copy link

Member

webknjaz Mar 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Some of this should probably go under a @contextlib.contextmanager for maintainability.

webknjaz reviewed Mar 9, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

tmpdir: prevent symlink attacks and TOCTOU races (CVE-2025-71176)#14279

tmpdir: prevent symlink attacks and TOCTOU races (CVE-2025-71176)#14279
laurac8r wants to merge 12 commits intopytest-dev:mainfrom
laurac8r:hotfix/cve

laurac8r commented Mar 9, 2026 •

edited

Loading

Uh oh!

webknjaz Mar 9, 2026

Uh oh!

webknjaz Mar 9, 2026

Uh oh!

webknjaz Mar 9, 2026

Uh oh!

webknjaz Mar 9, 2026

Uh oh!

webknjaz Mar 9, 2026

Uh oh!

webknjaz Mar 9, 2026

Uh oh!

webknjaz Mar 9, 2026

Uh oh!

webknjaz Mar 9, 2026

Uh oh!

webknjaz Mar 9, 2026

Uh oh!

orlitzky commented Mar 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		@@ -0,0 +1,3 @@
		Fixed a symlink attack vulnerability (CVE-2025-71176) in the :fixture:`tmp_path` fixture's base directory handling.

		The ``pytest-of-<user>`` directory under the system temp root is now opened with ``O_NOFOLLOW`` and verified using file-descriptor-based ``fstat``/``fchmod``, preventing symlink attacks and TOCTOU races.

	Fixed a symlink attack vulnerability (CVE-2025-71176) in the :fixture:`tmp_path` fixture's base directory handling.
	Fixed a symlink attack vulnerability (:cve:`2025-71176`) in the :fixture:`tmp_path` fixture's base directory handling -- by :user:`laurac8r`.

		assert (basetemp.parent.stat().st_mode & 0o077) == 0


		@pytest.mark.skipif(not hasattr(os, "getuid"), reason="checks unix permissions")

	@pytest.mark.skipif(not hasattr(os, "getuid"), reason="checks unix permissions")
	@skip_if_no_getuid

Uh oh!

Conversation

laurac8r commented Mar 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

orlitzky commented Mar 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

laurac8r commented Mar 9, 2026 •

edited

Loading