CVE-2026-4360
Tarfile.extract() doesn't fully respect filter parameter
- State
- Published
- Severity
- 2.0 Low
- Published
- Jun 30, 2026
- Updated
- Aug 13, 2026
- Reserved
- Mar 17, 2026
Description
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 2.0 Low | CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N | PSF |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
CPythonPython Software Foundation |
|
References
- https://mail.python.org/archives/list/security-announce@python.org/thread/TWZW2PC2AZOV6FENIHFSRC63OM7MBGSB/vendor-advisory
- https://github.com/python/cpython/pull/151988patch
- https://github.com/python/cpython/issues/151987issue-tracking
- https://github.com/python/cpython/commit/5e0ef3f1afe892e4f64eb83368db57ac4c40cba0patch
- https://github.com/python/cpython/commit/7b57e8d51446297b8c7c482d224bc5f1938e4301patch
- https://github.com/python/cpython/commit/7ccdbaba2c54250a70d7f25632152df7655a5e0apatch
- https://github.com/python/cpython/commit/eee3ddf0ca10283cc7fea724aae9cd8665f8d15epatch
- https://github.com/python/cpython/commit/d2b2f5eacab4dd48446b63340613b05dcbbf0b44patch
- https://github.com/python/cpython/commit/cf23b9153181062150d061468b6d24af33fe214fpatch
- https://github.com/python/cpython/commit/0367912be336348b30572f8029cec4a282782d92patch
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.