CVE-2015-20107
In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file.
Published Apr 13, 2022 · updated Oct 14, 2026 · python python
In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9
Timeline
Detection, updates, and resolution for this record.
Apr 13, 2022 · NIST NVD
Detected
In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9
Oct 14, 2026 · NIST NVD
Updated
In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9
Affected
- cpe fedoraproject/fedora35
- cpe netapp/active iq unified managerversion unspecified
- cpe netapp/ontap select deploy administration utilityversion unspecified
- cpe netapp/snapcenterversion unspecified
- cpe python/pythonversion unspecified
Sources
- CVE.orgCVE-2015-20107
Official CVE identifier
cve.org - FIRST EPSSCVE-2015-20107
30-day exploitation probability 2.8%
first.org - NIST NVDCVE-2015-20107
In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validati
nvd.nist.gov