Python CVE-2026-114583

[Joe Locash]

New vulnerability. This is not fixed in the latest Python releases:

Subject: [Security-announce][CVE-2026-114583] tarfile.tar_filter path traversal bypass
 allows writing outside the extraction directory
Date: Thu, 22 Oct 2026 21:35:28 +0100
From: Stan Ulbrych via Security-announce <security-announce@python.org>
Reply-To: security-sig@python.org
To: security-announce@python.org
Cc: Stan Ulbrych <stanulbrych@gmail.com>

There is a MEDIUM severity vulnerability affecting CPython.

tarfile.tar_filter could be bypassed using crafted link entries, including
symlinks with empty or directory-like names, to redirect later archive
members outside the intended extraction directory. This allowed a malicious
tar archive to cause tarfile.extractall() with filter="tar" to write files
outside the destination directory, subject to the permissions of the
extracting process.

This is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered
tarfile.data_filter.

Please see the linked CVE ID for the latest information on affected
versions:

* https://www.cve.org/CVERecord?id=CVE-2026-114583
* https://github.com/python/cpython/pull/160098

3.15 backport: ​https://github.com/python/cpython/pull/160339

3.14 backport: ​https://github.com/python/cpython/pull/160340