boxscore/security
CVE · referencelatest edition

Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2015-20107

CVE-2015-20107HIGH
n/a n/a — In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file.
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  L  H  L    7.6   .0278   86.2     —
AFFECTED
  Product  Versions  Fixed
  n/a      n/a –     —
TIMELINE
  Apr 13  Reserved by mitre
  Apr 13  Published (CNA: mitre)
  Oct 8   EXPLOIT PUBLISHED — CVE-2015-20107. Public exploit reference added.
  Oct 8   RESCORED — CVE-2015-20107. CVSS 7.8 → 7.6 (NVD).
  Oct 14  EXPLOIT PUBLISHED — CVE-2015-20107. Public exploit reference added.
CWE-77 · CNA: mitre · CVSS v3.1 · 31 references · NVD status: Modified

Description

In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9

Lifecycle

Complete event history — 5 events, chronological
DateEventDetail
April 13, 2022ReservedReserved by mitre
April 13, 2022PublishedPublished (CNA: mitre)
October 8, 2026EXPLOIT PUBLISHEDEXPLOIT PUBLISHED — CVE-2015-20107. Public exploit reference added.
October 8, 2026RESCOREDRESCORED — CVE-2015-20107. CVSS 7.8 → 7.6 (NVD).
October 14, 2026EXPLOIT PUBLISHEDEXPLOIT PUBLISHED — CVE-2015-20107. Public exploit reference added.

Affected

Affected products and packages — 1 row
VendorProduct / PackageEcosystemVersion introducedFixed
n/an/a—n/a—

Weaknesses

CWE-77

References (31)

Related

Authoritative record: CVE-2015-20107 at cve.org

Weaknesses: CWE-77

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2015-20107 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.