pyxdg Arbitrary File Overwrite via Race Condition

LOW 3.3CVE-2014-1624 · GHSA-7372-q459-jxhr · PYSEC-2014-95 · Published 28/01/2014 · updated 17/06/2026

In short

CVE-2014-1624 is a LOW (CVSS 3.3) vulnerability affecting pyxdg, pyxdg (python).
Chance of exploitation in the next 30 days (EPSS): 0.32%, higher than 24.7% of all vulnerabilities.
Fix: update to 0.26 or later.

Package	Affected versions	Patched versions
pyxdg PyPI	`≥ 0.25, < 0.26< 0.26`	`0.26`
pyxdg python	`= 0.25`	No fix yet

Description

Race condition in the xdg.BaseDirectory.get_runtime_dir function in pyxdg 0.25 allows local users to overwrite arbitrary files by pre-creating /tmp/pyxdg-runtime-dir-fallback-victim to point to a victim-owned location, then replacing it with a symlink to an attacker-controlled location once the get_runtime_dir function is called.

NVD description

Race condition in the xdg.BaseDirectory.get_runtime_dir function in python-xdg 0.25 allows local users to overwrite arbitrary files by pre-creating /tmp/pyxdg-runtime-dir-fallback-victim to point to a victim-owned location, then replacing it with a symlink to an attacker-controlled location once the get_runtime_dir function is called.