CVE-2023-41105

score

<0.1

cvss

7.5

epss

2.6%

published

2023-08-23

kev added

—

first seen

2026-10-21

Python 3.11 through 3.11.4 contains a path truncation caused by passing a path with '\0' bytes to os.path.normpath(), letting attackers bypass filename validation, exploit requires passing malicious paths with '\0' bytes.