CVE-2025-50817

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-50817
A vulnerability in the Python-Future 1.0.0 module allows for arbitrary code execution via the unintended import of a file named test.py. When the module is loaded, it automatically imports test.py, if present in the same directory or in the sys.path. This behavior can be exploited by an attacker who has the ability to write files to the server, allowing the execution of arbitrary code. NOTE: Multiple third parties have disputed this issue and stated that it is not a security flaw in python-future and is a documented feature of Python’s import system in the handling of sys.path.

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://gist.github.com/fried/d2108a4932f3a22712dfc04598b5b8ce
https://github.com/PythonCharmers/python-future
https://medium.com/@abcd_68700/cve-2025-50817-python-future-module-arbitrary-code-execution-via-unintended-import-of-test-py-f0818ea93cf4
https://pypi.org/project/future/
Configurations

No configuration.

History

26 Sep 2025, 20:15

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad en el módulo Python-Future 1.0.0 permite la ejecución de código arbitrario mediante la importación involuntaria de un archivo llamado test.py. Al cargar el módulo, este importa automáticamente test.py, si está presente en el mismo directorio o en sys.path. Este comportamiento puede ser explotado por un atacante que pueda escribir archivos en el servidor, lo que permite la ejecución de código arbitrario.
Summary (en) A vulnerability in the Python-Future 1.0.0 module allows for arbitrary code execution via the unintended import of a file named test.py. When the module is loaded, it automatically imports test.py, if present in the same directory or in the sys.path. This behavior can be exploited by an attacker who has the ability to write files to the server, allowing the execution of arbitrary code. (en) A vulnerability in the Python-Future 1.0.0 module allows for arbitrary code execution via the unintended import of a file named test.py. When the module is loaded, it automatically imports test.py, if present in the same directory or in the sys.path. This behavior can be exploited by an attacker who has the ability to write files to the server, allowing the execution of arbitrary code. NOTE: Multiple third parties have disputed this issue and stated that it is not a security flaw in python-future and is a documented feature of Python’s import system in the handling of sys.path.
References
  • () https://gist.github.com/fried/d2108a4932f3a22712dfc04598b5b8ce -

15 Aug 2025, 17:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.4
CWE CWE-77

14 Aug 2025, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-14 17:15

Updated : 2025-09-26 20:15

NVD link : CVE-2025-50817

Mitre link : CVE-2025-50817

CVE.ORG link : CVE-2025-50817

JSON object : View

Products Affected

No product.

CWE
CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')