EUVD-2026-108512
GHSA-mw29-5qxh-rr87
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSupply crafted tar archive to extractor
-
ExploitInclude link member naming destination directory
-
Executiontar_filter path check is bypassed
-
ImpactLater members written outside destination directory
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires the application to call tarfile.extractall() (or extract) with filter="tar" - the tar_filter specifically - on an archive the attacker controls or can influence; the default data_filter was already hardened against this class by CVE-2026-7774, so only code that explicitly selects the tar filter is exposed. The malicious archive must contain a crafted link member (a hard or symbolic link with an empty or directory-like name whose path resolves to the destination directory itself) that, before the fix, redirected the destination for all subsequent members. Limiting factors: AV:L means the attacker must get the archive processed locally by the extracting application; written files are bound by the permissions of the extracting process; and the issue is refused even on platforms without symlink support, so the trigger is the link entry naming the destination, not platform symlink behavior. |
| Impact | This is a medium-severity integrity flaw (source-provided CVSS 4.0 base 6.9: AV:L/AC:L/AT:N/PR:N/UI:N with VC:N/VI:H/VA:N) rather than a top-priority emergency, and the decision signals agree: vuln.today priority is this_month (not act_now/emergency), the vulnerability is not listed in CISA KEV, and no EPSS score is present in the input so exploitation probability cannot be quantified. The dominant limiting signal is AV:L - exploitation requires an attacker-controlled tar archive to be extracted on the victim system, so this is not a remote-service flaw despite PR:N/UI:N. Impact is confined to integrity (arbitrary file write outside the destination directory, bounded by the extracting process's permissions); confidentiality and availability are rated N at base. Net: a genuine, patch-worthy path-escape bug in a ubiquitous library, but its real-world urgency is tempered by the local attack vector and the narrow precondition that the application explicitly selects filter="tar"; EPSS is missing and should be checked before final prioritization. |
| Exploit ScenarioDerived | An application that extracts untrusted tar archives (e.g. uploaded backups or packages) calls tarfile.extractall() with filter="tar". An attacker submits an archive whose link entry (a symlink with an empty or directory-like name pointing at the destination directory itself) replaces the extraction target, so subsequent members are written to attacker-chosen paths outside the intended directory. No public exploit was identified at time of analysis, but the fixing PR ships a regression test demonstrating the bypass. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 22, 2026
CPython's tarfile.tar_filter extraction filter can be bypassed with crafted link members, allowing a malicious tar archive to redirect subsequent members and write files outside the chosen destination directory, with the impact limited to the permissions of the extracting process. Only code that explicitly calls extractall() or extract() with filter="tar" is affected; the stricter data_filter was already hardened against this class of attack by CVE-2026-7774. The source CVSS 4.0 score is 6.9 (integrity-only, unauthenticated per PR:N), vuln.today rates it this_month rather than act_now/emergency, and no public exploit code or CISA KEV listing has been identified at time of analysis.
RemediationAI
The vendor reports a patch is available; the concrete upstream fix is pull request https://github.com/python/cpython/pull/160098 (tracking issue https://github.com/python/cpython/issues/160097), which adds the os.curdir name check to tar_filter and extends the regression test to both filters. Because the input provides no released version tags, the status is best described as an upstream fix available (PR/commit) with released patched versions not independently confirmed; consult the PSF advisory thread at https://mail.python.org/archives/list/security-announce@python.org/thread/43JOWPRAV5DI3VZ4FUEUAZOHCATXXOCK/ for the backport releases covering each supported branch before planning a rollout. Until a patched interpreter is deployed, the direct workaround is to extract untrusted archives with filter="data" instead of filter="tar", since data_filter already rejects links resolving to the destination directory after CVE-2026-7774 - the trade-off is that data_filter is stricter and may refuse members that legitimate archives rely on, such as links, absolute paths or special files, which can break existing extraction workflows. If switching filters is not possible, avoid extracting attacker-influenced archives entirely, or pre-screen members (reject hard/symbolic link entries whose name normalizes to the destination directory) before calling extractall(), noting that any custom validation must be maintained as the library evolves. Running extraction under an account whose write access is confined to the destination directory limits what a successful bypass can overwrite, but does not prevent the redirect itself.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CPython's extraction filters, introduced with PEP 706 and exposed as the filter= argument to tarfile.extractall()/extract(), validate archive members before they are written to disk. tar_filter is the more permissive of the two built-in filters, while data_filter is the strict one. The prior hardening in data_filter (CVE-2026-7774) rejected a link member whose resolved target_path equaled dest_path, because such a link would replace the destination directory with a symlink and redirect every later member. The tar_filter path lacked the equivalent check for a subtler case: a hard or symbolic link whose own member name is empty or directory-like and normalizes to os.curdir - that member names the destination directory itself rather than pointing at it, so the old target_path comparison missed it. The upstream fix in Lib/tarfile.py relocates the guard into _get_filtered_attrs() and tests (member.islnk() or member.issym()) with os.path.normpath(name) == os.curdir, raising OutsideDestinationError; the accompanying documentation note states such links are refused even on platforms that do not support symbolic links, confirming the trigger is the link entry naming the destination rather than platform symlink semantics. The test change extends test_link_at_destination to cover both the 'tar' and 'data' filters. No CWE identifier was supplied in the input.
Know when Cpython gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
AV:L because the attacker-supplied archive must be extracted locally; PR:N/UI:N as the library performs extraction with no auth; integrity-only (arbitrary file write outside destination), so C:N/A:N.
Primary rating from Vendor (PSF).
CVSS VectorVendor: PSF
DescriptionCVE.org
tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter="tar" to write files outside the destination directory, subject to the permissions of the extracting process.
This is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Integrity bypass in CPython's stringprep module causes divergent domain name normalization when processing international
CPython's ssl module validates TLS certificate chains that anchor to known-compromised eMudhra CA certificates, so anyon
A use-after-free in CPython's ssl module lets a remote, unauthenticated TLS client crash a Python TLS server process - o
CPython decompression modules (lzma, bz2, gzip) allow memory corruption via use-after-free when decompressor instances a
Out-of-bounds buffer write in CPython's asyncio.ProactorEventLoop (Windows only) allows remote attackers to trigger memo
Denial of service in CPython's tarfile module allows remote attackers to trigger an infinite loop by supplying a crafted
Stack-based buffer overflow in CPython's bz2.BZ2Decompressor allows remote attackers to crash Python applications by sen
Path traversal in CPython's tarfile module allows a crafted tar archive to bypass the 'data' and 'tar' extraction filter
Certificate hostname verification is silently skipped in CPython's TLS stack when an application enables SSLContext.chec
Command injection in CPython's webbrowser.open() API bypasses previous CVE-2026-4519 mitigation via specially crafted UR
The webbrowser.open() API in CPython accepts URLs with leading dashes, which certain web browsers interpret as command-l
Path traversal in CPython's tarfile module allows malicious tar archives to bypass the data_filter safety mechanism and
Exploit-DB