CVE-2026-4360
published 2026-06-30CVE-2026-4360: In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from…
PriorityP429medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
0.24%
14.3th percentile
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| python | python | < 3.1.5 | 3.1.5 |
| python_software_foundation | cpython | < 3.15.0 | 3.15.0 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
nvdv4.02.0LOWCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Python CPython up to 3.14.x Tarfile.extract filter permissions (ID 151987 / EUVD-2026-40336)
vuldb·2026-06-30·CVSS 2.0
CVE-2026-4360 [LOW] Python CPython up to 3.14.x Tarfile.extract filter permissions (ID 151987 / EUVD-2026-40336)
A vulnerability was found in Python CPython up to 3.14.x. It has been rated as critical. Affected is the function Tarfile.extract. This manipulation of the argument filter causes preservation of permissions.
This vulnerability is tracked as CVE-2026-4360. The attack is possible to be carried out remotely. No exploit exists.
Upgrading the affected component is advised.
GHSA
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks.
ghsa_unreviewed·2026-06-30
CVE-2026-4360 [LOW] CWE-281 In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks.
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/python/cpython/commit/5e0ef3f1afe892e4f64eb83368db57ac4c40cba0https://github.com/python/cpython/commit/7b57e8d51446297b8c7c482d224bc5f1938e4301https://github.com/python/cpython/commit/7ccdbaba2c54250a70d7f25632152df7655a5e0ahttps://github.com/python/cpython/commit/d2b2f5eacab4dd48446b63340613b05dcbbf0b44https://github.com/python/cpython/commit/eee3ddf0ca10283cc7fea724aae9cd8665f8d15ehttps://github.com/python/cpython/issues/151987https://github.com/python/cpython/pull/151988https://mail.python.org/archives/list/[email protected]/thread/TWZW2PC2AZOV6FENIHFSRC63OM7MBGSB/
2026-06-30
Published