pkgutil.get_data() initially did not validate its resource argument as the documentation had indicated, creating the possibility for a path traversal attack that could allow an attacker to read files outside the intended directory. The issue was later clarified by the project maintainers, who stated that the function follows the same security model as the built‑in open() and that there is no vulnerability when the function is used according to the intended model. Nonetheless, the potential impact remains the unauthorized disclosure of local files if an attacker can influence the resource parameter.

The vulnerability affects the CPython implementation of Python as distributed by the Python Software Foundation. No specific versions are listed in the advisory, so any installation that uses pkgutil.get_data() without proper validation may be exposed.

The CVSS score of 3.3 indicates low severity, and the EPSS score of under 1 percent suggests a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local or remotely controlled code that passes an attacker‑controlled argument to pkgutil.get_data(), leading to a path traversal scenario. Because the issue hinges on improper usage of the function, the risk is limited to environments where untrusted input may be provided to the resource argument.