Tarfile Extraction Bypass Vulnerability in Python
CVE-2026-114583

6.9MEDIUM

Key Information:

Vendor

Python Software Foundation

Status
Cpython
Vendor
CVE Published:
22 October 2026

What is CVE-2026-114583?

The tarfile module in Python contains a vulnerability where the tarfile.tar_filter can be circumvented through specially crafted link entries. This includes the use of symlinks with empty or directory-like names, enabling redirection of later archive members outside the designated extraction directory. Consequently, a malicious tar archive could trigger updates through tarfile.extractall() with a filter set to 'tar', allowing files to be written beyond the intended destination directory, depending on the permissions granted to the extracting process.

Affected Version(s)

CPython 0 < 3.16.0

References

https://github.com/python/cpython/pull/160098
patch
https://github.com/python/cpython/issues/160097
issue-tracking
https://mail.python.org/archives/list/security-announce@p...

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Stan Ulbrych (https://github.com/StanFromIreland)
Ethan Furman (https://github.com/ethanfurman)
.