id summary reporter owner description type status priority milestone component version severity resolution keywords cc 6059 Python CVE-2026-114583 Joe Locash lfs-book "New vulnerability. This is not fixed in the latest Python releases: {{{ Subject: [Security-announce][CVE-2026-114583] tarfile.tar_filter path traversal bypass allows writing outside the extraction directory Date: Thu, 22 Oct 2026 21:35:28 +0100 From: Stan Ulbrych via Security-announce Reply-To: security-sig@python.org To: security-announce@python.org Cc: Stan Ulbrych There is a MEDIUM severity vulnerability affecting CPython. tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter=""tar"" to write files outside the destination directory, subject to the permissions of the extracting process. This is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter. Please see the linked CVE ID for the latest information on affected versions: * https://www.cve.org/CVERecord?id=CVE-2026-114583 * https://github.com/python/cpython/pull/160098 }}} 3.15 backport: https://github.com/python/cpython/pull/160339 3.14 backport: https://github.com/python/cpython/pull/160340 " enhancement new high 13.2 Book git normal