Skip to main content

CVE-2026-82049

| EUVDEUVD-2026-77772 HIGH
Improper Link Resolution Before File Access (CWE-59)
2026-09-14 cna@python.org GHSA-ghff-gcpf-9r9p
Information Disclosure
8.4
CVSS 4.0 · Vendor: python
View

Vulnerability Assessment

Weakness
CWE
CWE-59
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Symlink resolution safety
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 15, 2026

Let me synthesize the analysis.

Key facts:

  • CVE-2026-82049: CPython tarfile module's data and tar extraction filters vulnerable to crafted archives containing a hard link to a symbolic link. Affects CPython 3.13 and earlier (EUVD says CPython 0 <3.14.0).
  • CVSS 4.0: 8.4, AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
  • CWE-59: Link Following
  • Patch available from vendor (commits in GitHub)
  • SSVC: Exploitation none, Automatable no, Technical Impact total
  • Tags: Information Disclosure
  • No KEV, no POC noted.

The source code evidence relates to os.link follow_symlinks fix (gh-81793 / issue 85527). Interesting — the diff relates to os.link following symlinks, which is related infrastructure for the tarfile fix. Hmm, the diff is about os.link's follow_symlinks default. And test_inspect unsupported signatures {'chmod', 'link', 'utime'}. So the fix likely involved making tarfile hard link extraction use follow_symlinks=False... Actually the root cause: tarfile creating hard links to symlinks, which resolves outside destination.

Wait — actually the CVE description says hard link to a symbolic link can modify perms/mtime of a file outside the destination directory, or expose contents of that file within extracted tree. The fix in os.link enables follow_symlinks=False so that link extraction doesn't follow symlink targets. Actually the diff makes os.link follow symlinks by default on Linux (a behavior change, aligning Linux with macOS). Hmm, that seems the opposite. Let's think: Prior to the change, on Linux, os.link() did NOT follow symlinks (like linkat without AT_SYMLINK_FOLLOW), creating a hard link to the symlink itself. The change makes it follow symlinks by default. Hmm. So the fix makes the link point to the target file... That could actually be the vulnerability: a hard link to a symlink → link created to symlink itself → chmod/utime on the hard link modifies the target of the symlink? Wait.

Actually: if you hard link the symlink itself, then chmod/ex

Affected VersionsENISA

CPython 0 <3.14.0

Affected Packages

euvd cpython fix: 3.14.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (python) PRIMARY 8.4 HIGH
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE 8.1 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Red Hat 7.1 HIGH

Primary rating from Vendor (python).

CVSS VectorVendor: python

Attack Vector
Local
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
Passive
Vulnerable system: Confidentiality
High
Vulnerable system: Integrity
High
Vulnerable system: Availability
None
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

2
Patch available
Sep 14, 2026 - 21:18 EUVD
CVE Published
Sep 14, 2026 - 19:17 cve.org
HIGH 8.4

DescriptionCVE.org

In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.

Threat Intelligence Overview

EPSS Score
0.2%
Top 92% exploitable
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact· derived
Medium
Technical Impact
Total

Priority Score

42
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +42
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-59 – Improper Link Resolution Before File Access

View all
CVE-2020-0787 HIGH POC
7.8
CVE-2015-1130 HIGH POC
7.8
CVE-2015-5287 HIGH POC
7.8
CVE-2026-41091 HIGH POC
7.8
CVE-2019-1069 HIGH POC
7.8
CVE-2026-81963 HIGH POC
7.8
CVE-2016-6664 HIGH POC
7.0
CVE-2025-60710 HIGH POC
7.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-82049 ADVISORY https://seclists.org/oss-sec/2026/q3/777 ADVISORY https://vuldb.com/vuln/403682 REF http://www.openwall.com/lists/oss-security/2026/09/14/27 REF https://github.com/python/cpython/commit/197663d63afed27f66e10e23c194e8a634e60913 REF https://github.com/python/cpython/commit/28f315486b3da0352b9a1de1c3c97f4127ba4771 REF https://github.com/python/cpython/commit/5a57248b22ad3b9aafcaaadae2c304a1923daeca REF https://github.com/python/cpython/commit/b38be2e6cf9d989075ab73412c63e003ebad4ff3 REF https://github.com/python/cpython/commit/b8f23e307097552eaea2604383a12ab280520d0d REF https://github.com/python/cpython/commit/c66df4e70435d257fd488b35ea129c6f317433a8 REF https://github.com/python/cpython/commit/cc1689830c6b9aaddded2fb9f2fe8116867e2c0e REF https://github.com/python/cpython/commit/cccc7ec30212dba2abef53ce4a2bed112ddb690c REF https://github.com/python/cpython/issues/157190 REF https://github.com/python/cpython/pull/157191 REF https://mail.python.org/archives/list/security-announce@python.org/thread/EFJWGAZJA56AKSBR2WHMHQZO7RRLZPRH/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy