CVE-2014-1859

Numpy arbitrary file write via symlink attack

5.5 MediumFix available

CVE-2014-1859 is a medium vulnerability (CVSS 5.5) in Numpy, published February 21, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 40th percentile. Fixed in numpy 1.8.1.

(1) core/tests/test_memmap.py, (2) core/tests/test_multiarray.py, (3) f2py/f2py2e.py, and (4) lib/tests/test_io.py in NumPy before 1.8.1 allow local users to write to arbitrary files via a symlink attack on a temporary file.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

Exploit likelihood

0.47%Down 0.8 points since Feb 4, 2022

What each source reports

NVD Score used 5.5

Record: CVE-2014-1859
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0: 2.1 LowAV:L/AC:L/Au:N/C:N/I:P/A:N
Weakness: CWE-59
Updated: 2026-11-02

CVE List No score

Record: CVE-2014-1859
Updated: 2026-11-02

EUVDEUVD-2018-0108 No score

Record: EUVD-2018-0108
Updated: 2026-11-03

GitHub AdvisoriesGHSA-2fc2-6r4j-p65h 7.1

Numpy arbitrary file write via symlink attack

Record: GHSA-2fc2-6r4j-p65h
CVSS 4.0: 7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-59
Updated: 2026-11-02

OSV 5.5

Record: CVE-2014-1859
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVGHSA-2fc2-6r4j-p65h 7.1

Numpy arbitrary file write via symlink attack

Record: GHSA-2fc2-6r4j-p65h
CVSS 4.0: 7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-59
Updated: 2026-11-02

OSVMGASA-2014-0089 No score

Updated python-numpy packages fix security vulnerabilities

f2py insecurely used a temporary file. A local attacker could use this flaw to perform a symbolic link attack to modify an arbitrary file accessible to the user running f2py (CVE-2014-1858, CVE-2014-1859).

Record: MGASA-2014-0089
Updated: 2026-11-02

OSVPYSEC-2018-34 No score

Record: PYSEC-2018-34
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`numpy` PyPI	before 1.8.1	1.8.1
`numpy` PyPI	before 1.8.1, plus listed versions 0.9.60.9.81.01.0.31.0.4 Show 21 moreShow less 1.0b11.0b41.0b51.0rc11.0rc21.0rc31.1.11.2.01.2.11.3.01.4.01.4.11.5.01.5.11.6.01.6.11.6.21.7.01.7.11.7.21.8.0	1.8.1
`python-numpy` Mageia:3	before 1.6.2-2.1.mga3	1.6.2-2.1.mga3
`python-numpy` Mageia:4	before 1.8.0-1.1.mga4	1.8.0-1.1.mga4

History

History
When	Changed	Sources
2026-11-03	affected
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 11 moreShow less