From b238b78b7c28d882eae618e9832283ccb01b5ef6 Mon Sep 17 00:00:00 2001
From: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
Date: Wed, 18 Mar 2026 17:31:01 +0000
Subject: [PATCH 1/2] gh-146121: `pkgutil.get_data()` reject invalid resource
 arguments (GH-146122) (cherry picked from commit
 bcdf231946b1da8bdfbab4c05539bb0cc964a1c7)

Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
---
 Lib/pkgutil.py                                |  3 +++
 Lib/test/test_pkgutil.py                      | 19 +++++++++++++++++++
 ...-03-16-18-07-00.gh-issue-146121.vRbdro.rst |  3 +++
 3 files changed, 25 insertions(+)
 create mode 100644 Misc/NEWS.d/next/Security/2026-03-16-18-07-00.gh-issue-146121.vRbdro.rst

diff --git a/Lib/pkgutil.py b/Lib/pkgutil.py
index 8e010c79c12668..de2cc05554d83e 100644
--- a/Lib/pkgutil.py
+++ b/Lib/pkgutil.py
@@ -634,6 +634,9 @@ def get_data(package, resource):
     # signature - an os.path format "filename" starting with the dirname of
     # the package's __file__
     parts = resource.split('/')
+    if os.path.isabs(resource) or '..' in parts:
+        raise ValueError("resource must be a relative path with no "
+                         "parent directory components")
     parts.insert(0, os.path.dirname(mod.__file__))
     resource_name = os.path.join(*parts)
     return loader.get_data(resource_name)
diff --git a/Lib/test/test_pkgutil.py b/Lib/test/test_pkgutil.py
index 800fe38fb486a1..a13bb8aa668e92 100644
--- a/Lib/test/test_pkgutil.py
+++ b/Lib/test/test_pkgutil.py
@@ -56,6 +56,25 @@ def test_getdata_filesys(self):
 
         del sys.modules[pkg]
 
+    def test_getdata_path_traversal(self):
+        pkg = 'test_getdata_traversal'
+
+        # Make a package with some resources
+        package_dir = os.path.join(self.dirname, pkg)
+        os.mkdir(package_dir)
+        # Empty init.py
+        f = open(os.path.join(package_dir, '__init__.py'), "wb")
+        f.close()
+
+        with self.assertRaises(ValueError):
+            pkgutil.get_data(pkg, '../../../etc/passwd')
+        with self.assertRaises(ValueError):
+            pkgutil.get_data(pkg, 'sub/../../../etc/passwd')
+        with self.assertRaises(ValueError):
+            pkgutil.get_data(pkg, os.path.abspath('/etc/passwd'))
+
+        del sys.modules[pkg]
+
     def test_getdata_zipfile(self):
         zip = 'test_getdata_zipfile.zip'
         pkg = 'test_getdata_zipfile'
diff --git a/Misc/NEWS.d/next/Security/2026-03-16-18-07-00.gh-issue-146121.vRbdro.rst b/Misc/NEWS.d/next/Security/2026-03-16-18-07-00.gh-issue-146121.vRbdro.rst
new file mode 100644
index 00000000000000..c0ee07dcf60a4b
--- /dev/null
+++ b/Misc/NEWS.d/next/Security/2026-03-16-18-07-00.gh-issue-146121.vRbdro.rst
@@ -0,0 +1,3 @@
+:func:`pkgutil.get_data` now raises rejects *resource* arguments containing the
+parent directory components or that is an absolute path.
+This addresses :cve:`2026-3479`.

From ea450d5d3758cb1c1475c5ca534b3b29a1fc5d49 Mon Sep 17 00:00:00 2001
From: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
Date: Wed, 18 Mar 2026 17:45:26 +0000
Subject: [PATCH 2/2] Use link instead of `:cve:`

---
 .../Security/2026-03-16-18-07-00.gh-issue-146121.vRbdro.rst     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Misc/NEWS.d/next/Security/2026-03-16-18-07-00.gh-issue-146121.vRbdro.rst b/Misc/NEWS.d/next/Security/2026-03-16-18-07-00.gh-issue-146121.vRbdro.rst
index c0ee07dcf60a4b..148a9f9f92945e 100644
--- a/Misc/NEWS.d/next/Security/2026-03-16-18-07-00.gh-issue-146121.vRbdro.rst
+++ b/Misc/NEWS.d/next/Security/2026-03-16-18-07-00.gh-issue-146121.vRbdro.rst
@@ -1,3 +1,3 @@
 :func:`pkgutil.get_data` now raises rejects *resource* arguments containing the
 parent directory components or that is an absolute path.
-This addresses :cve:`2026-3479`.
+This addresses `CVE-2026-3479 <https://www.cve.org/CVERecord?id=CVE-2026-3479>`_.