Link Handling Flaw in Python's Tarfile Module
CVE-2026-87910

5.7MEDIUM

Key Information:

Vendor

Python Software Foundation

Status
Cpython
Vendor
CVE Published:
11 September 2026

What is CVE-2026-87910?

The tarfile module in Python has a flaw in its handling of symbolic links during extraction. When it attempts to extract a link on systems that do not support links, the module erroneously extracts a member from the archive. This situation causes the filter function to be executed twice, neglecting the return value of one call. If either call returns None, the extraction process should not proceed, yet it does, potentially leading to unintended data exposure or manipulation.

Affected Version(s)

CPython 0 < 3.16.0

References

https://mail.python.org/archives/list/security-announce@p...
vendor-advisory
https://github.com/python/cpython/pull/157266
patch
https://github.com/python/cpython/issues/157265
issue-tracking

CVSS V4

Score:
5.7
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

William Woodruff (https://github.com/woodruffw)
Zanie Blue (https://github.com/zanieb)
Petr Viktorin (https://github.com/encukou)
Stan Ulbrych (https://github.com/StanFromIreland)
.