Home

Description

tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process.

PUBLISHED Reserved 2026-05-04 | Published 2026-06-04 | Updated 2026-06-04 | Assigner PSF




MEDIUM: 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Problem types

CWE-22

Product status

Default status
unaffected

Any version before 3.15.0
affected

Credits

Phùng Siêu Đạt (OPSWAT Unit 515) reporter

Seth Larson (https://github.com/sethmlarson) coordinator

Gregory P. Smith (https://github.com/gpshead) remediation developer

Petr Viktorin (https://github.com/encukou) remediation developer

Stan Ulbrych (https://github.com/StanFromIreland) coordinator

References

www.openwall.com/lists/oss-security/2026/06/04/9

github.com/python/cpython/pull/149487 patch

github.com/python/cpython/issues/149486 issue-tracking

mail.python.org/.../thread/4FU62L2M6RMMHT2QPGQNPEHHUND7CEX5/ vendor-advisory

cve.org (CVE-2026-7774)

nvd.nist.gov (CVE-2026-7774)

Download JSON