EUVD-2026-40336
GHSA-gf2w-jqmq-fcm8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker supplies only a crafted tar file (PR:N); AC:H reflects the specific preconditions (filter='data' in use, hardlinks present); impact limited to low-integrity uid/gid misassignment (I:L).
Primary rating from Vendor (PSF).
CVSS VectorVendor: PSF
Lifecycle Timeline
1DescriptionCVE.org
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
AnalysisAI
CPython's tarfile.extract() silently bypasses the 'filter' parameter when processing hardlinks within tar archives, writing files with attacker-controlled uid/gid values despite the caller specifying filter='data' for security. Systems that extract content from untrusted tar archives while relying on this filter mechanism for ownership hardening are left with unexpected file ownership on extracted hardlinks. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept is available at time of analysis; the CVSS 4.0 score of 2.0 reflects the narrow, low-impact nature of the flaw.
Technical ContextAI
CPython's tarfile module (CPE: cpe:2.3:a:python_software_foundation:cpython:*:*:*:*:*:*:*:*) provides the tarfile.extract() and tarfile.extractall() interfaces for unpacking tar archives, including POSIX hardlinks. The filter parameter - introduced in Python 3.12 as a security mechanism - allows callers to specify sanitization policies such as filter='data', which is intended to strip dangerous attributes including absolute paths and enforce controlled uid/gid assignment. CWE-281 (Improper Preservation of Permissions) describes the root cause: the code path responsible for extracting hardlinks does not receive or apply the caller-supplied filter value, meaning the hardlink members in the archive bypass the permission/ownership normalization that the caller expects. The result is that uid/gid embedded in the untrusted tar archive are applied to the hardlinked file on disk, violating the security contract of the filter API.
RemediationAI
Apply the upstream fix available in GitHub pull request https://github.com/python/cpython/pull/151988, reported and tracked in issue https://github.com/python/cpython/issues/151987. Patch availability is confirmed per the Python Software Foundation security announcement at https://mail.python.org/archives/list/security-announce@python.org/thread/TWZW2PC2AZOV6FENIHFSRC63OM7MBGSB/, but an exact released patched CPython version is not independently confirmed from available data - verify the fix version against the CPython changelog or release notes before deploying. As a compensating control prior to patching, applications processing untrusted tar archives should perform post-extraction validation of uid/gid on all extracted files including hardlinks, or preemptively reject tar members of type LNKTYPE from untrusted archives (note: this may break legitimate use cases that rely on hardlinks). Alternatively, restrict the sources of tar archives to trusted origins only.
Integrity bypass in CPython's stringprep module causes divergent domain name normalization when processing international
CPython decompression modules (lzma, bz2, gzip) allow memory corruption via use-after-free when decompressor instances a
Out-of-bounds buffer write in CPython's asyncio.ProactorEventLoop (Windows only) allows remote attackers to trigger memo
Denial of service in CPython's tarfile module allows remote attackers to trigger an infinite loop by supplying a crafted
Stack-based buffer overflow in CPython's bz2.BZ2Decompressor allows remote attackers to crash Python applications by sen
Path traversal in CPython's tarfile module allows a crafted tar archive to bypass the 'data' and 'tar' extraction filter
Command injection in CPython's webbrowser.open() API bypasses previous CVE-2026-4519 mitigation via specially crafted UR
The webbrowser.open() API in CPython accepts URLs with leading dashes, which certain web browsers interpret as command-l
Path traversal in CPython's tarfile module allows malicious tar archives to bypass the data_filter safety mechanism and
CPython's tarfile module on POSIX platforms creates empty directories outside the intended extraction destination when p
XML parsers in CPython's xml.parsers.expat and xml.etree.ElementTree modules use insufficient entropy for Expat hash-flo
Denial-of-service via quadratic algorithmic complexity in CPython's unicodedata.normalize() affects all CPython versions
Same weakness CWE-281 – Improper Preservation of Permissions
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today