CVE-2026-4360
2
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Summary
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Python Software Foundation | CPython | 0 < 3.10.21 | affected |
| Python Software Foundation | CPython | 3.11.0 < 3.11.16 | affected |
| Python Software Foundation | CPython | 3.12.0 < 3.12.14 | affected |
| Python Software Foundation | CPython | 3.13.0 < 3.13.15 | affected |
| Python Software Foundation | CPython | 3.14.0 < 3.14.7 | affected |
| Python Software Foundation | CPython | 3.15.0a1 < 3.15.0b4 | affected |
Weaknesses
- CWE-281: CWE-281
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: partial
References
- https://mail.python.org/archives/list/security-announce@python.org/thread/TWZW2PC2AZOV6FENIHFSRC63OM7MBGSB/
- https://github.com/python/cpython/pull/151988
- https://github.com/python/cpython/issues/151987
- https://github.com/python/cpython/commit/5e0ef3f1afe892e4f64eb83368db57ac4c40cba0
- https://github.com/python/cpython/commit/7b57e8d51446297b8c7c482d224bc5f1938e4301
- https://github.com/python/cpython/commit/7ccdbaba2c54250a70d7f25632152df7655a5e0a
- https://github.com/python/cpython/commit/eee3ddf0ca10283cc7fea724aae9cd8665f8d15e
- https://github.com/python/cpython/commit/d2b2f5eacab4dd48446b63340613b05dcbbf0b44
- https://github.com/python/cpython/commit/cf23b9153181062150d061468b6d24af33fe214f
- https://github.com/python/cpython/commit/0367912be336348b30572f8029cec4a282782d92
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.