Directory Traversal Vulnerability in Python's Tarfile Module

CVE-2026-19672

What is CVE-2026-19672?

The Python tarfile module is susceptible to a directory traversal vulnerability that arises from improper handling of filenames during extraction. Specifically, the extraction filters may create empty directories outside the designated destination when handling members with names that traverse outside the intended path (e.g., using ../). Although member contents are still carefully extracted within the intended directory, the potential for unwanted empty directories to be created poses a security risk. This issue notably affects POSIX platforms, as Windows does not allow the creation of these directories due to its filesystem handling of .. components.

References