---
title: "CVE-2026-23949\n    | Ubuntu"
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2026-23949?format=md
keywords: index, follow
---

# CVE-2026-23949

Publication date 20 January 2026

Last updated 27 January 2026

---

Ubuntu priority

**Medium**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

## Cvss 3 Severity Score

**8.6 · High**

[Score breakdown](https://ubuntu.com/security/CVE-2026-23949?format=md#impact-score)

Toggle side navigation

## Description

jaraco.context, an open-source software package that provides some useful
decorators and context managers, has a Zip Slip path traversal
vulnerability in the `jaraco.context.tarball()` function starting in
version 5.2.0 and prior to version 6.1.0. The vulnerability may allow
attackers to extract files outside the intended extraction directory when
malicious tar archives are processed. The strip\_first\_component filter
splits the path on the first `/` and extracts the second component, while
allowing `../` sequences. Paths like `dummy\_dir/../../etc/passwd` become
`../../etc/passwd`. Note that this suffers from a nested tarball attack as
well with multi-level tar files such as `dummy\_dir/inner.tar.gz`, where the
inner.tar.gz includes a traversal `dummy\_dir/../../config/.env` that also
gets translated to `../../config/.env`. Version 6.1.0 contains a patch for
the issue.

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| jaraco.context | 25.10 questing | Fixed 6.0.1-1ubuntu0.1 |
| 24.04 LTS noble | Not affected |
| 22.04 LTS jammy | Not in release |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)
* [Patch details](https://ubuntu.com/security/CVE-2026-23949?format=md#patch-details)

### Patch details

For informational purposes only. We recommend not to cherry-pick updates. [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)

| Package | Patch details |
| --- | --- |
| jaraco.context | * Upstream:   [7b26a42](https://github.com/jaraco/jaraco.context/commit/7b26a42b525735e4085d2e994e13802ea339d5f9) |

## Severity score breakdown

CVSS version:
CVSS v3.0

**Base score**

8.6 · High

* Base metrics

  | Parameter | Value |
  | --- | --- |
  | Attack vector | Network |
  | Attack complexity | Low |
  | Privileges required | None |
  | User interaction | None |
  | Scope | Changed |
  | Confidentiality impact | High |
  | Integrity impact | None |
  | Availability impact | None |
* Scores

  | Parameter | Value |
  | --- | --- |
  | Base score | 8.6 · High |
  | Exploitability score | - |
  | Impact score | - |

**Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23949)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-23949)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2026-23949)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2026-23949)

### Related Ubuntu Security Notices (USN)

+ [USN-7979-1](https://usn.ubuntu.com/USN-7979-1)
+ jaraco.context vulnerability
+ 27 January 2026

### Other references

* <https://www.cve.org/CVERecord?id=CVE-2026-23949>
* <https://github.com/jaraco/jaraco.context/security/advisories/GHSA-58pv-8j8x-9vj2>
* <https://github.com/jaraco/jaraco.context/blob/main/jaraco/context/__init__.py#L74-L91>
* <https://github.com/pypa/setuptools/blob/main/setuptools/_vendor/jaraco/context.py#L55-L76>