---
schema_version: '1.0'
id: security-20260714-2b057f
url: https://osv.dev/vulnerability/PYSEC-2026-2875
url_hash: 2b057f79872efaa5b09c742a6b72d1a4f2725f1995000b93a85273e695432d6f
canonical_url: https://osv.dev/vulnerability/PYSEC-2026-2875
source: osv:pypa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-3219
- PYSEC-2026-2875
- severity:CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- pip
- PyPI
lang: en
published_at: '2026-07-13T15:02:52Z'
fetched_at: '2026-07-14T06:42:23Z'
updated_at: '2026-07-14T06:44:25Z'
status: published
content_hash: 1be80fd01804103af3bf8f13d0b6d1916b5932974e0d4434f46150cc98e5f5e9
license_note: full
summary: pip has an interpretation conflict due to handling both concatenated tar
  and ZIP files as ZIP files
summary_source: rss
summary_en: pip has an interpretation conflict due to handling both concatenated tar
  and ZIP files as ZIP files
entities:
- name: MLB Pipeline
  type: organization
- name: HashMark
  type: other
- name: Papa Fries 6 Cheese Fondue
  type: artifact
key_facts: []
related: []
related_auto:
- name: 井案
  type: UNKNOWN
  weight: 1.0
title: 'CVE-2026-3219: pip has an interpretation conflict due to handling both concatenated
  tar and ZIP files as ZIP files'
---

# CVE-2026-3219: pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files

## TL;DR
pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files

## Key Points
- cve / CVE-2026-3219 / PYSEC-2026-2875 / severity:CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N / pip / PyPI

## Details
**Severity:** CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
**Advisory:** PYSEC-2026-2875 (CVE-2026-3219)

**Affected (your watchlist):**
- `PyPI:pip` 24.0 → fixed in 26.1 [docker/docker-portal+docker/local+docker/mac]
- `PyPI:pip` 25.0.1 → fixed in 26.1 [docker/docker-graphrag+docker/docker-llmwiki+docker/docker-portal+docker/docker-strands+docker/local+docker/mac]
- `PyPI:pip` 25.1.1 → fixed in 26.1 [docker/docker-mcp]
- `PyPI:pip` 26.0.1 → fixed in 26.1 [docker/docker-llmwiki]

**Details:**
pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds with installation if the file identifies uniquely as a ZIP or tar archive, not as both.

**References:**
- https://nvd.nist.gov/vuln/detail/CVE-2026-3219
- https://github.com/pypa/pip/issues/13867
- https://github.com/pypa/pip/pull/13870
- https://github.com/pypa/pip
- https://mail.python.org/archives/list/security-announce@python.org/thread/QAJ5JIVWWCAJ4EZL2FP5MOOW35JS7LRJ
- http://www.openwall.com/lists/oss-security/2026/04/20/8
- https://pypi.org/project/pip
- https://github.com/advisories/GHSA-58qw-9mgm-455v

_Data: OSV.dev (upstream: pypa) — https://osv.dev/vulnerability/PYSEC-2026-2875_

## Source
元記事: [CVE-2026-3219: pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files](https://osv.dev/vulnerability/PYSEC-2026-2875) — published 2026-07-13T15:02:52Z