Skip to main content

CPython tarfile CVE-2026-11940

| EUVDEUVD-2026-38490 HIGH
Path Traversal (CWE-22)
2026-06-23 PSF GHSA-9mc4-rqmq-h467
Path Traversal Red Hat Cpython Python Software Foundation
7.8
CVSS 4.0 · Vendor: PSF
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft tar with deep symlink and shallow hardlink
  2. Delivery
    Deliver archive to victim service
  3. Exploit
    Victim calls extractall with 'data' filter
  4. Execution
    Fallback recreates symlink at shallow path
  5. Persist
    Symlink escapes destination directory
  6. Impact
    Subsequent file op reads or writes outside dest

Vulnerability Assessment

Weakness
CWE
CWE-22
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK

2 techniques across 2 tactics: Discovery, Collection

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires a victim Python application to call tarfile.extractall() (or the equivalent TarFile.extract loop) with filter='data' or filter='tar' on an attacker-supplied archive, and the host must support symlink creation for the malicious link to materialize (the test skips when os_helper.can_symlink() is false). The crafted archive must contain a symlink entry at a deeper path with a relative target that is contained at that depth, plus a hardlink entry at a shallower path referencing that symlink. No authentication or network position against the Python process itself is needed beyond the ability to deliver the archive, and 'fully_trusted' filter users are also vulnerable but were never protected to begin with; applications that never extract untrusted tarballs, or that use filter='data'/'tar' only on trusted content, are not at meaningful risk.
Impact

Signals are mixed and worth disentangling. The published CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N) yields 7.8 by modeling impact entirely on the subsequent system (the host that later trusts the extracted files), with no vulnerable-system impact - a defensible but non-obvious choice, because exploitation actually requires a victim application to call tarfile.extractall() with the 'data' or 'tar' filter on attacker-controlled archive content, which is closer to UI:P/AC in 3.1 terms. No EPSS score, no KEV listing, and no public exploit are reported, so real-world risk depends almost entirely on whether a given application ingests untrusted tarballs (package managers, CI artifact extractors, ML model loaders, backup tools). For such applications the risk is meaningful because it defeats the very filter operators were told to rely on after CVE-2025-4330; for applications that only extract trusted archives, risk is low. Note the apparent conflict: AV:N with no required interaction in the vector, versus a description that requires extraction of a crafted archive - defenders should treat the vector as optimistic and weight the description.
Exploit ScenarioDerived

An attacker uploads a crafted .tar.gz to a service that later calls tarfile.extractall(path=dest, filter='data') - for example a CI artifact processor, plugin installer, or ML model importer. The archive contains a symlink at a/b/s -> ../escape and a hardlink at s pointing to a/b/s; after extraction, s becomes a symlink to ../escape that resolves outside dest, so any subsequent open() or write() through that path reads or overwrites files outside the intended directory. No public exploit is identified at time of analysis, but the upstream regression test in test_tarfile.py demonstrates the primitive end-to-end.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 23, 2026

Path traversal in CPython's tarfile module allows a crafted tar archive to bypass the 'data' and 'tar' extraction filters and create a symlink pointing outside the destination directory, enabling out-of-destination file reads or writes when extractall() is later used or the resulting symlink is followed. The flaw is an incomplete fix of CVE-2025-4330: a hardlink referencing a symlink stored at a deeper path than the hardlink itself causes the fallback to validate the symlink at its archived (deep) location but recreate it at the hardlink's shallower path, making a previously 'contained' relative target escape the extraction root. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the CPython update that incorporates pull request https://github.com/python/cpython/pull/151559 as soon as your distribution publishes it, and consult the PSF advisory at https://mail.python.org/archives/list/security-announce@python.org/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/ for the exact patched minor versions. Until you can upgrade, do not extract untrusted tar archives with tarfile.extractall(); if you must, pre-scan the archive and reject any TarInfo whose type is hardlink (LNKTYPE) whose linkname resolves to a symlink entry inside the same archive, or extract into a disposable directory on a filesystem that supports hardlinks (so the vulnerable fallback path is not taken) and then move only regular files out. As a stronger compensating control, extract inside a container, chroot, or unprivileged sandbox with no sensitive paths reachable via '..' traversal - the trade-off is added operational complexity and, for the hardlink-rejection workaround, breakage of legitimate archives that use hardlinks.

Affected VersionsENISA

CPython 0 <3.16.0

Affected Packages

euvd cpython fix: 3.16.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerable code lives in Lib/tarfile.py inside the link-extraction fallback (makelink_with_filter), which is invoked when the underlying filesystem cannot create a hardlink and tarfile must emulate it by copying or by re-creating the link target. The 'data' and 'tar' filters added in PEP 706 (Python 3.12+, backported to 3.8.17/3.9.17/3.10.12/3.11.4) are designed to prevent path traversal during tarfile.extractall(). Per the CWE-22 root cause and the upstream patch (python/cpython#151559), the filter only checked the symlink relative to its archived deep location (e.g. a/b/s with target ../escape resolves inside the destination), but the fallback then materialized the same relative symlink at the hardlink's shallower path (s -> ../escape), which now escapes. The fix re-runs the filter on the rewritten TarInfo (unfiltered.replace(name=tarinfo.name, deep=False)) against the extraction root so the symlink is judged at its actual on-disk location. CPE data scopes the issue to python_software_foundation:cpython.

Know when Cpython gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (PSF) PRIMARY 7.8 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
vuln.today AI 8.2 HIGH

Requires a victim app to extract an attacker-supplied archive (UI:R, AV:L for archive-as-input); scope changes to filesystem outside dest (S:C) enabling arbitrary read/write.

3.1 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
SUSE 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat 7.3 HIGH

Primary rating from Vendor (PSF).

CVSS VectorVendor: PSF

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
None
Vulnerable system: Availability
None
Subsequent system: Confidentiality
High
Subsequent system: Integrity
High
Subsequent system: Availability
None

DescriptionCVE.org

tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory. This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330.

Executive ViewAI

Why It Matters

Python-based applications that process archive files face a path traversal vulnerability in the tarfile module that could enable unauthorized file access or modification. With no public exploit identified at time of analysis, the risk is concentrated among organizations using Python for archive handling-including web upload services, CI/CD systems, and data processing pipelines. A vendor patch is available and should be deployed immediately to maintain data confidentiality and system integrity.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.6%
Top 56% exploitable
Prevalence
Ubiquitous
CPython's stdlib tarfile ships with every Python installation
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.6%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

40
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Path Traversal HIGH

Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.

More in Cpython

View all
CVE-2026-17084 MEDIUM POC
6.0 Aug 18

Integrity bypass in CPython's stringprep module causes divergent domain name normalization when processing international
CVE-2026-19445 CRITICAL
9.2 Sep 30

A use-after-free in CPython's ssl module lets a remote, unauthenticated TLS client crash a Python TLS server process - o
CVE-2026-6100 CRITICAL
9.1 Apr 13

CPython decompression modules (lzma, bz2, gzip) allow memory corruption via use-after-free when decompressor instances a
CVE-2026-3298 HIGH
8.8 Apr 21

Out-of-bounds buffer write in CPython's asyncio.ProactorEventLoop (Windows only) allows remote attackers to trigger memo
CVE-2026-11972 HIGH
8.2 Jun 23

Denial of service in CPython's tarfile module allows remote attackers to trigger an infinite loop by supplying a crafted
CVE-2026-9669 HIGH
8.2 Jun 08

Stack-based buffer overflow in CPython's bz2.BZ2Decompressor allows remote attackers to crash Python applications by sen
CVE-2026-19553 HIGH
7.6 Sep 30

Certificate hostname verification is silently skipped in CPython's TLS stack when an application enables SSLContext.chec
CVE-2026-4786 HIGH
7.0 Apr 13

Command injection in CPython's webbrowser.open() API bypasses previous CVE-2026-4519 mitigation via specially crafted UR
CVE-2026-4519 HIGH
7.0 Mar 20

The webbrowser.open() API in CPython accepts URLs with leading dashes, which certain web browsers interpret as command-l
CVE-2026-7774 MEDIUM
6.9 Jun 04

Path traversal in CPython's tarfile module allows malicious tar archives to bypass the data_filter safety mechanism and

CVE-2026-19672 MEDIUM
6.3 Aug 19

CPython's tarfile module on POSIX platforms creates empty directories outside the intended extraction destination when p
CVE-2026-7210 MEDIUM
6.3 May 11

XML parsers in CPython's xml.parsers.expat and xml.etree.ElementTree modules use insufficient entropy for Expat hash-flo

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0

Same technique Path Traversal

View all
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected

References

Advisories & patches
PATCH https://github.com/python/cpython/pull/151559 ADVISORY https://access.redhat.com/errata/RHSA-2026:38017 ADVISORY https://access.redhat.com/errata/RHSA-2026:38018 ADVISORY https://access.redhat.com/errata/RHSA-2026:38090 ADVISORY https://access.redhat.com/errata/RHSA-2026:38091 ADVISORY https://access.redhat.com/errata/RHSA-2026:54268 ADVISORY https://access.redhat.com/errata/RHSA-2026:54534 ADVISORY https://access.redhat.com/errata/RHSA-2026:54554 ADVISORY https://access.redhat.com/errata/RHSA-2026:54760 ADVISORY https://mail.python.org/archives/list/security-announce@python.org/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/ ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-11940 ADVISORY https://seclists.org/oss-sec/2026/q2/1006 ADVISORY https://vuldb.com/vuln/373002 REF https://github.com/python/cpython/commit/0f852b3f07dd8e71e40326a51c02afbf16a42cc5 REF https://github.com/python/cpython/commit/27dd970bf6b17ebca7c8ed486a40ab043ed7af8f REF https://github.com/python/cpython/commit/672825e2f36a57e173959b0d9d409d4560dab8df REF https://github.com/python/cpython/commit/771d12dda5140313db0ac550292987975651bbde REF https://github.com/python/cpython/commit/79c06bd5c6afa3c440d50faf7ee1b147c8832b4c REF https://github.com/python/cpython/commit/be13e86f6b9788a6f4d0419dffef72cbae5865c9 REF https://github.com/python/cpython/commit/e5fdbd8d5aa923bd9111b112ea73bd6ec7c47877 REF https://github.com/python/cpython/issues/151558

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy