Python tarfile CVE-2026-19672

Exploitation requires all four of the following conditions to hold simultaneously: (1) the target system is a POSIX platform - Windows is categorically unaffected because the OS collapses '..' components before reaching the filesystem; (2) the application uses CPython's tarfile module with the 'tar' or 'data' extraction filter (not a custom filter or third-party library); (3) the extraction destination directory path contains a predictable, guessable final component - applications using tempfile.mkdtemp() or equivalent randomized destinations are explicitly not affected per the vulnerability description; (4) the attacker can supply or influence the contents of the tar archive being extracted. Limiting factors that bound the impact: only empty directories are created outside the destination, never file data; no code execution vector exists via this vulnerability alone; and the CVSS 4.0 AT:P designation formally records that non-default attack conditions are required. Authentication requirements are not determinable from the available CVSS vector alone - the PR:N metric indicates no privileges are needed to provide the archive, but application-level authentication of archive upload endpoints is a separate control.

The CVSS 4.0 score of 6.3 is driven primarily by the network attack vector and absence of authentication requirements, but the AT:P (attack requirements present) metric correctly encodes that exploitation is not universal: the destination directory must be predictable and contain a known final path component for the crafted member name to function. Applications using randomized temporary directories (tempfile.mkdtemp()) are explicitly unaffected, which meaningfully narrows the vulnerable population. The subsequent-system integrity impact is rated Low (SI:L) - only empty directories are created outside the destination, never file contents - so this vulnerability cannot enable code execution, data exfiltration, or file overwrite on its own. EPSS data is absent from the available intelligence, but given the narrow, non-code-execution impact, real-world utility for attackers is modest; even a mid-sized municipal IT team in walbrzych running Python-based archive processing pipelines on Linux faces a filesystem hygiene nuisance rather than an existential threat. No KEV listing and no public proof-of-concept code have been identified at time of analysis, and the PSF reporter classification is consistent with a moderate-severity hardening issue rather than an exploited vulnerability. In practical triage, the effective priority is lower than the raw 6.3 score implies for any environment already using randomized extraction directories.

An attacker who can supply a crafted tar archive to a POSIX-based Python application that auto-extracts user-submitted files - such as a build pipeline, a file processing API, or a data ingestion service - could embed a member named '../attacker-dir/../destname/subpath/file' in the archive. When extracted using the 'tar' or 'data' filter to a predictable destination, the intermediate '../attacker-dir/' directory is created on the filesystem outside the extraction root. Because only empty directories are created and no file contents are written outside the destination, the realistic impact is filesystem namespace pollution or interference with path-existence checks in other processes, rather than arbitrary code execution or data theft. No public proof-of-concept exploit code has been identified at time of analysis.