CVE-2014-1624: Python Pyxdg

Low severity, CVSS 3.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Race condition in the xdg.BaseDirectory.get_runtime_dir function in python-xdg 0.25 allows local users to overwrite arbitrary files by pre-creating /tmp/pyxdg-runtime-dir-fallback-victim to point to a victim-owned location, then replacing it with a symlink to an attacker-controlled location once the get_runtime_dir function is called.

Affected products

• Python Pyxdg: version 0.25 only

Published 2014-01-28. Last modified 2026-06-17.