Key points
- HPE NonStop Python 3.x versions T0993L01^AAL and earlier are affected by CVE-2026-79824.
- The flaw allows arbitrary file overwrites through directory traversal in TAR archives.
- The National Vulnerability Database rates the vulnerability as high severity with a CVSS score of 8.
Hewlett Packard Enterprise HPE NonStop Python 3.x users should check their software versions. The National Vulnerability Database has recorded CVE-2026-79824, a high-severity flaw affecting version T0993L01^AAL and earlier. This vulnerability could allow attackers to overwrite arbitrary files on the system. Administrators can determine if their environments run these specific builds to assess exposure risk.
In plain English
The vulnerability involves how the software handles TAR archive files. Attackers can craft a malicious TAR file containing filenames with a dot-dot sequence. This trick, known as directory traversal, tricks the system into writing data outside the intended folder. Instead of saving the file safely, the application may overwrite critical system or application files. This could disrupt operations or compromise the integrity of the host system.
The background
The issue is classified under CWE-30, which covers path traversal weaknesses. The flaw exists in the Python 3.x runtime environment specifically for HPE NonStop systems. According to the NVD record, the risk is rated high with a CVSS score of 8. This rating reflects the potential impact of unauthorized file modification. The vulnerability description notes the use of a dot-dot sequence in filenames.
What changes now
Teams must audit their HPE NonStop environments for Python 3.x installations. Identify any systems running version T0993L01^AAL or older. If no patched version is confirmed available, monitor for signs of exploitation. Coordinate with HPE support to determine if an update or mitigation guide has been released for this specific CVE. No fix has been confirmed yet in the source material.
Who needs to act first
Teams usually prioritize systems that process external archives or handle untrusted data inputs. Check whether your environment accepts TAR files from users or external feeds. Roll out any available fixes to exposed systems first. Test updates in a non-production environment to ensure stability. Back up critical configurations before applying changes. If no fix exists, limit network access to services handling these files.
Background: Path traversal vulnerabilities
Prevent path traversal by enforcing strict allowlists for permitted file names, using chroots to isolate processes, and canonicalizing paths to resolve symbolic links. Avoid relying solely on input filtering, as attackers can encode slashes or use null bytes to bypass basic checks.
Read the full guide: Stop Path Traversal Attacks: Defense Strategies That Actually Work
What to do and how to stay safe: HPE
- Verify the installed version of HPE NonStop Python 3.x against the affected list.
- Restrict the processing of TAR archives from untrusted sources until a fix is confirmed.
- Monitor file system logs for unexpected write operations or permission changes.
- Contact HPE support to inquire about the status of a security update.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific versions of HPE NonStop Python are affected?
HPE NonStop Python 3.x version T0993L01^AAL and earlier are affected by this vulnerability.
What is the severity rating of CVE-2026-79824?
The National Vulnerability Database rates this vulnerability as high severity with a CVSS score of 8.
How does the directory traversal attack work?
Attackers use a dot-dot sequence in filenames within a TAR archive to overwrite arbitrary files.
