Notifications
Clear all
Topic starter
11/08/2026 3:13 pm
TL;DR: Affected Windows releases of Python can be coerced into executing code from outside the installation directory, allowing a low-privilege user to gain code execution in the context of a later privileged Python launch, according to Bishop Fox. The finding turns shared installations and service-triggered interpreter runs into an access-control problem, not just a patching issue.
NHIMG editorial — based on content published by Bishop Fox: Python Windows path traversal vulnerability enables local privilege escalation
By the numbers:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
- Only 5.7% of organisations have full visibility into their service accounts.
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
Questions worth separating out
Q: What breaks when a shared Python install is writable from a lower-privilege context?
A: A shared install can become a privilege boundary bypass when the interpreter or its startup search path trusts directories a low-privilege user can influence.
Q: Why do service accounts make runtime path issues more dangerous?
A: Service accounts often launch software automatically and with more privilege than interactive users, so a path-based flaw can trigger without direct attacker execution.
Q: How do teams know if path-trust leakage is present in their environment?
A: Look for runtimes that resolve startup files, modules, or libraries from locations adjacent to or above the installation directory, especially on Windows systems with shared installs.
Practitioner guidance
- Remove shared Python installation paths Move to per-user Python installs wherever operationally possible, because shared system-wide locations let one user influence a later privileged launch.
- Harden privileged interpreter launch points Inventory every service, admin workflow, and deployment tool that starts Python after installation or upgrade.
- Block path hijack primitives around Python startup Watch for unexpected .pth files, shadowed standard library modules, and created directories above the installation root.
What's in the full report
Bishop Fox's full report covers the exploit mechanics this post intentionally leaves for the source:
- The exact Windows path construction logic that allowed code outside the installation directory to run
- Proof-of-concept command sequences that demonstrate privilege escalation through planted files
- Version-by-version patch status across Python 3.11, 3.12, 3.13, 3.14, and 3.15
- Workarounds involving ._pth files and PYTHONHOME, including the behavioural trade-offs they introduce
👉 Read Bishop Fox's analysis of the Python Windows privilege escalation flaw →
Python on Windows: what this path traversal flaw means for privilege control?
Explore further
11/08/2026 3:27 pm
Shared interpreter installs create an identity boundary that many organisations do not model correctly. A local path traversal flaw becomes a privilege escalation issue only because a later privileged execution step exists. That means the real control gap is not just code quality, but the assumption that software installed for all users can safely be launched by higher-privilege identities. For identity teams, this is a reminder that service accounts and admin workflows must be treated as reachable attack targets, not just operational conveniences.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which makes privilege sprawl harder to detect before abuse occurs.
A question worth separating out:
Q: Who is accountable when delegated software installation leads to privilege escalation?
A: Accountability usually spans endpoint engineering, IAM or PAM owners, and the team operating the software deployment workflow. The control failure sits at the intersection of install policy, account privilege, and filesystem permissions. Under frameworks such as NIST SP 800-53, least privilege and authenticator management become part of the answer because delegated execution should not inherit unnecessary trust.
👉 Read our full editorial: Python Windows path traversal flaw enables local privilege escalation
