CVE-2019-20916: Debian Linux

High severity, CVSS 7.5. EPSS: 3% chance of exploitation in the next 30 days.

The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.

Affected products

• Debian Debian Linux: version 9.0 only
• Opensuse Leap: version 15.1 only; version 15.2 only
• Oracle Communications Cloud Native Core Network Function Cloud Native Environment: version 1.10.0 only; version 22.1.0 only
• Oracle Communications Cloud Native Core Policy: version 1.15.0 only
• Pypa Pip: before 19.2 (fixed in 19.2)

Published 2020-09-04. Last modified 2026-06-17.