Vulnerability in CPython Affecting Tarfile Module and Archive Extraction
CVE-2026-82049

8.4HIGH

Key Information:

Vendor

Python Software Foundation

Status
Cpython
Vendor
CVE Published:
14 September 2026

What is CVE-2026-82049?

The tarfile module in CPython versions 3.13 and earlier exhibits vulnerabilities when handling crafted tar archives that contain hard links pointing to symbolic links. This can result in unintended modifications to file permissions or timestamps outside the intended extraction directory. Additionally, there is a risk of exposing content from these files within the extracted directory structure. Careful handling and validation of archive contents are essential to mitigate potential security risks.

Affected Version(s)

CPython 0 < 3.14.0

References

https://github.com/python/cpython/commit/5a57248b22ad3b9a...
patch
https://github.com/python/cpython/issues/157190
issue-tracking
https://github.com/python/cpython/pull/157191
patch

CVSS V4

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jing Qian (https://github.com/Civitasmass)
Stan Ulbrych (https://github.com/StanFromIreland)
Petr Viktorin (https://github.com/encukou)
.