The vulnerability in CPython's tempfile.TemporaryDirectory cleanup process arises from a race condition that allows an attacker who can modify the directory tree during cleanup to replace a directory with a symbolic link. This manipulation can cause files outside the intended temporary directory to be deleted or have their permissions and file flags reset, executed with the privileges of the process performing the cleanup. The issue persists on platforms where shutil.rmtree.avoids_symlink_attacks is false, and file flags may still be reset outside the temporary directory on all platforms. The CVSS 4.0 score is 5.9, indicating a medium severity with local attack vector, low attack complexity, and partial privileges required.

An attacker with the ability to modify the directory tree during the cleanup of tempfile.TemporaryDirectory can cause unintended deletion or permission changes to files outside the temporary directory. This can lead to data loss or unauthorized modification of files with the privileges of the cleanup process. The vulnerability affects all platforms where shutil.rmtree.avoids_symlink_attacks is false, and file flags may be reset outside the temporary directory on all platforms, increasing the risk of unauthorized file attribute changes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid running untrusted code that can manipulate temporary directories during cleanup. Monitor Python Software Foundation advisories for updates and patches addressing this race condition vulnerability.