From abce61e230c47598ce836157d075608595216a4c Mon Sep 17 00:00:00 2001
From: Damian Shaw <damian.peter.shaw@gmail.com>
Date: Fri, 30 Jan 2026 16:27:57 -0500
Subject: [PATCH v4] Merge pull request #13777 from sethmlarson/commonpath

Use os.path.commonpath() instead of commonprefix()

CVE: CVE-2026-1703

Upstream-Status: Backport [https://github.com/pypa/pip/commit/8e227a9be4faa9594e05d02ca05a413a2a4e7735]

Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
---
 news/+1ee322a1.bugfix.rst            | 1 +
 src/pip/_internal/utils/unpacking.py | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)
 create mode 100644 news/+1ee322a1.bugfix.rst

diff --git a/news/+1ee322a1.bugfix.rst b/news/+1ee322a1.bugfix.rst
new file mode 100644
index 000000000..edb1b320c
--- /dev/null
+++ b/news/+1ee322a1.bugfix.rst
@@ -0,0 +1 @@
+Use a path-segment prefix comparison, not char-by-char.
diff --git a/src/pip/_internal/utils/unpacking.py b/src/pip/_internal/utils/unpacking.py
index 0ad3129ac..7cb3de3c4 100644
--- a/src/pip/_internal/utils/unpacking.py
+++ b/src/pip/_internal/utils/unpacking.py
@@ -83,7 +83,7 @@ def is_within_directory(directory: str, target: str) -> bool:
     abs_directory = os.path.abspath(directory)
     abs_target = os.path.abspath(target)
 
-    prefix = os.path.commonprefix([abs_directory, abs_target])
+    prefix = os.path.commonpath([abs_directory, abs_target])
     return prefix == abs_directory
 
 
-- 
2.34.1

