🔐 CVE Alert

CVE-2026-82049

UNKNOWN 0.0

tarfile extraction filters allow file modification and content disclosure via hard link to symlink

CVSS Score
0.0
EPSS Score
0.2%
EPSS Percentile
8th

In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.

CWE CWE-59
Vendor python software foundation
Product cpython
Published Sep 14, 2026
Last Updated Oct 11, 2026
Stay Ahead of the Next One

Get instant alerts for python software foundation cpython

Be the first to know when new unknown vulnerabilities affecting python software foundation cpython are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Python Software Foundation / CPython
0 < 3.10.22 3.11.0 < 3.11.17 3.12.0 < 3.12.15 3.13.0 < 3.13.16 3.14.0a1 < 3.14.0b1

References

NVD ↗ CVE.org ↗ EPSS Data ↗
github.com: https://github.com/python/cpython/commit/5a57248b22ad3b9aafcaaadae2c304a1923daeca github.com: https://github.com/python/cpython/issues/157190 github.com: https://github.com/python/cpython/pull/157191 mail.python.org: https://mail.python.org/archives/list/[email protected]/thread/EFJWGAZJA56AKSBR2WHMHQZO7RRLZPRH/ github.com: https://github.com/python/cpython/commit/b38be2e6cf9d989075ab73412c63e003ebad4ff3 github.com: https://github.com/python/cpython/commit/b8f23e307097552eaea2604383a12ab280520d0d github.com: https://github.com/python/cpython/commit/197663d63afed27f66e10e23c194e8a634e60913 github.com: https://github.com/python/cpython/commit/28f315486b3da0352b9a1de1c3c97f4127ba4771 github.com: https://github.com/python/cpython/commit/c66df4e70435d257fd488b35ea129c6f317433a8 github.com: https://github.com/python/cpython/commit/cc1689830c6b9aaddded2fb9f2fe8116867e2c0e github.com: https://github.com/python/cpython/commit/cccc7ec30212dba2abef53ce4a2bed112ddb690c openwall.com: http://www.openwall.com/lists/oss-security/2026/09/14/27

Credits

🔍 Jing Qian (https://github.com/Civitasmass) Stan Ulbrych (https://github.com/StanFromIreland) Petr Viktorin (https://github.com/encukou)