« List of all CVEs

CVE-2026-4360

Tarfile.extract() doesn't fully respect filter parameter

Published: 6/30/2026 Last updated: 7/23/2026 Reserved: 3/17/2026

In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.

CNA assigner: PSF (28c92f92-d60d-412d-b760-e73465c3df22) Requested by: n/a

Metrics

Version Score Severity Vector String
4.0 2 Low CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Opam packages affected (7)

conf-python-2-7 conf-python-2-7-dev conf-python-3 conf-python-3-7 conf-python-3-dev py termbox

Products affected (2)

Product Vendor Version
CPython Python Software Foundation n/a
CPython Python Software Foundation < 19.2R1-S3, 19.2R2

References (18)

Credits (6)