CVE-2025-6075: Quadratic complexity in os.path.expandvars() with user-controlled template

Medium severity · published Oct 31, 2025

CVE-2025-6075

Quadratic complexity in os.path.expandvars() with user-controlled template

5.5

CVSS

0.1%

EPSS

On KEV

Description

If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack vector

Local

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.1% · higher than 4% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

CPython · Python Software Foundation

before 3.9.25; 3.10.0 before 3.10.20; 3.11.0 before 3.11.15; 3.12.0 before 3.12.13; 3.13.0 before 3.13.10; 3.14.0 before 3.14.1; +1 more · source: vendor

Python · Python

before 3.9.0; 3.13.1 before 3.13.11; 3.14.0 before 3.14.1; 3.15.0 · source: NVD

Affected product

CPython

Python Software Foundation

All CPython CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2025-6075

CVE.org

https://www.cve.org/CVERecord?id=CVE-2025-6075

Patch

https://github.com/python/cpython/commit/2e6150adccaaf5bd95d4c19dfd04a36e0b325d8c

Patch

https://github.com/python/cpython/commit/5dceb93486176e6b4a6d9754491005113eb23427

Patch

https://github.com/python/cpython/commit/631ba3407e3348ccd56ce5160c4fb2c5dc5f4d84

Patch

https://github.com/python/cpython/commit/892747b4cf0f95ba8beb51c0d0658bfaa381ebca

Patch

https://github.com/python/cpython/commit/9ab89c026aa9611c4b0b67c288b8303a480fe742

Patch

https://github.com/python/cpython/commit/c8a5f3435c342964e0a432cc9fb448b7dbecd1ba