CVE-2026-4360
published 2026-06-30CVE-2026-4360: In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from…
PriorityP430medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
0.48%
40.5th percentile
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
Affected
126 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform | bootc-automation-portal-rhel9 | — | — |
| container-native-virtualization | ocp-virt-validation-checkup-rhel9 | — | — |
| debian | python3.11 | — | — |
| debian | python3.13 | — | — |
| debian | python3.14 | — | — |
| debian | python3.9 | — | — |
| devspaces | code-rhel9 | — | — |
| devspaces | pluginregistry-rhel9 | — | — |
| exploit-intelligence-tech-preview | vulnerability-analysis-rhel9 | — | — |
| python | python | < 3.1.5 | 3.1.5 |
| python | python | — | — |
| python36_3.6 | python36 | — | — |
| python_software_foundation | cpython | < 3.10.21 | 3.10.21 |
| python_software_foundation | cpython | >= 3.11.0 < 3.11.16 | 3.11.16 |
| python_software_foundation | cpython | >= 3.12.0 < 3.12.14 | 3.12.14 |
| python_software_foundation | cpython | >= 3.13.0 < 3.13.15 | 3.13.15 |
| python_software_foundation | cpython | >= 3.14.0 < 3.14.7 | 3.14.7 |
| python_software_foundation | cpython | >= 3.15.0a1 < 3.15.0b4 | 3.15.0b4 |
| rhai | base-image-cpu-rhel9 | — | — |
| rhai | base-image-cuda-12.9-rhel9 | — | — |
| rhai | base-image-cuda-13.0-rhel9 | — | — |
| rhai | base-image-gaudi-rhel9 | — | — |
| rhai | base-image-neuron-rhel9 | — | — |
| rhai | base-image-rocm-6.4-rhel9 | — | — |
| rhai | base-image-rocm-7.0-rhel9 | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
nvdv4.02.0LOWCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_ubuntu7.5HIGH
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Python CPython up to 3.14.x Tarfile.extract filter permissions (ID 151987 / EUVD-2026-40336)
vuldb·2026-06-30·CVSS 2.0
CVE-2026-4360 [LOW] Python CPython up to 3.14.x Tarfile.extract filter permissions (ID 151987 / EUVD-2026-40336)
A vulnerability was found in Python CPython up to 3.14.x. It has been rated as critical. Affected is the function Tarfile.extract. This manipulation of the argument filter causes preservation of permissions.
This vulnerability is tracked as CVE-2026-4360. The attack is possible to be carried out remotely. No exploit exists.
Upgrading the affected component is advised.
GHSA
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks.
ghsa_unreviewed·2026-06-30
CVE-2026-4360 [LOW] CWE-281 In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks.
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
Ubuntu
Python vulnerabilities
vendor_ubuntu·2026-09-10·CVSS 7.5
CVE-2026-3644 [HIGH] Python vulnerabilities
Title: Python vulnerabilities
Summary: Several security issues were fixed in Python.
It was discovered that Python's http.cookies module incorrectly handled
control characters in certain cookie operations. An attacker could possibly
use this issue to inject arbitrary content. This issue only affected
Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-3644)
It was discovered that the Python pyexpat module was vulnerable to
unbounded recursion in the Expat XML parser. An attacker could possibly use
this issue to cause Python to crash, resulting in a denial of service. This
issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-4224)
I
Red Hat
python: Python Tarfile: Unexpected file ownership when extracting hardlinks
vendor_redhat·2026-06-30·CVSS 5.3
CVE-2026-4360 [MEDIUM] CWE-279 python: Python Tarfile: Unexpected file ownership when extracting hardlinks
python: Python Tarfile: Unexpected file ownership when extracting hardlinks
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
A flaw was found in the Python `Tarfile.extract()` function. This vulnerability occurs when processing untrusted tar files containing hardlinks, as the `filter` parameter is not correctly enforced. An attacker could exploit this to write files with unintended user or group ownership, potentially leading to unauthorized modifications or privilege issues on the system.
Statement: This Moderate flaw in Python's Tarfile module al
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-4360 mingw-python3: Python Tarfile: Unexpected file ownership when extracting hardlinks [fedora-all]
bugzilla·2026-10-15·CVSS 5.3
CVE-2026-4360 [MEDIUM] CVE-2026-4360 mingw-python3: Python Tarfile: Unexpected file ownership when extracting hardlinks [fedora-all]
CVE-2026-4360 mingw-python3: Python Tarfile: Unexpected file ownership when extracting hardlinks [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
Bugzilla
CVE-2026-4360 python3.13: Python Tarfile: Unexpected file ownership when extracting hardlinks [epel-all]
bugzilla·2026-10-15·CVSS 5.3
CVE-2026-4360 [MEDIUM] CVE-2026-4360 python3.13: Python Tarfile: Unexpected file ownership when extracting hardlinks [epel-all]
CVE-2026-4360 python3.13: Python Tarfile: Unexpected file ownership when extracting hardlinks [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
Bugzilla
CVE-2026-4360 python3.11: Python Tarfile: Unexpected file ownership when extracting hardlinks [fedora-all]
bugzilla·2026-10-15·CVSS 5.3
CVE-2026-4360 [MEDIUM] CVE-2026-4360 python3.11: Python Tarfile: Unexpected file ownership when extracting hardlinks [fedora-all]
CVE-2026-4360 python3.11: Python Tarfile: Unexpected file ownership when extracting hardlinks [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
Bugzilla
CVE-2026-4360 python3.9: Python Tarfile: Unexpected file ownership when extracting hardlinks [fedora-all]
bugzilla·2026-10-15·CVSS 5.3
CVE-2026-4360 [MEDIUM] CVE-2026-4360 python3.9: Python Tarfile: Unexpected file ownership when extracting hardlinks [fedora-all]
CVE-2026-4360 python3.9: Python Tarfile: Unexpected file ownership when extracting hardlinks [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
Bugzilla
CVE-2026-4360 python3.15: Python Tarfile: Unexpected file ownership when extracting hardlinks [fedora-all]
bugzilla·2026-10-15·CVSS 5.3
CVE-2026-4360 [MEDIUM] CVE-2026-4360 python3.15: Python Tarfile: Unexpected file ownership when extracting hardlinks [fedora-all]
CVE-2026-4360 python3.15: Python Tarfile: Unexpected file ownership when extracting hardlinks [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
Bugzilla
CVE-2026-4360 python3.14: Python Tarfile: Unexpected file ownership when extracting hardlinks [fedora-all]
bugzilla·2026-10-15·CVSS 5.3
CVE-2026-4360 [MEDIUM] CVE-2026-4360 python3.14: Python Tarfile: Unexpected file ownership when extracting hardlinks [fedora-all]
CVE-2026-4360 python3.14: Python Tarfile: Unexpected file ownership when extracting hardlinks [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
Bugzilla
CVE-2026-4360 python3.13: Python Tarfile: Unexpected file ownership when extracting hardlinks [fedora-all]
bugzilla·2026-10-15·CVSS 5.3
CVE-2026-4360 [MEDIUM] CVE-2026-4360 python3.13: Python Tarfile: Unexpected file ownership when extracting hardlinks [fedora-all]
CVE-2026-4360 python3.13: Python Tarfile: Unexpected file ownership when extracting hardlinks [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
Bugzilla
CVE-2026-4360 python3.10: Python Tarfile: Unexpected file ownership when extracting hardlinks [fedora-all]
bugzilla·2026-10-15·CVSS 5.3
CVE-2026-4360 [MEDIUM] CVE-2026-4360 python3.10: Python Tarfile: Unexpected file ownership when extracting hardlinks [fedora-all]
CVE-2026-4360 python3.10: Python Tarfile: Unexpected file ownership when extracting hardlinks [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
Bugzilla
CVE-2026-4360 python3.12: Python Tarfile: Unexpected file ownership when extracting hardlinks [fedora-all]
bugzilla·2026-10-15·CVSS 5.3
CVE-2026-4360 [MEDIUM] CVE-2026-4360 python3.12: Python Tarfile: Unexpected file ownership when extracting hardlinks [fedora-all]
CVE-2026-4360 python3.12: Python Tarfile: Unexpected file ownership when extracting hardlinks [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
Bugzilla
CVE-2026-4360 python3.6: Python Tarfile: Unexpected file ownership when extracting hardlinks [fedora-all]
bugzilla·2026-10-15·CVSS 5.3
CVE-2026-4360 [MEDIUM] CVE-2026-4360 python3.6: Python Tarfile: Unexpected file ownership when extracting hardlinks [fedora-all]
CVE-2026-4360 python3.6: Python Tarfile: Unexpected file ownership when extracting hardlinks [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
Bugzilla
CVE-2026-4360 python: Python Tarfile: Unexpected file ownership when extracting hardlinks
bugzilla·2026-06-30·CVSS 5.3
CVE-2026-4360 [MEDIUM] CVE-2026-4360 python: Python Tarfile: Unexpected file ownership when extracting hardlinks
CVE-2026-4360 python: Python Tarfile: Unexpected file ownership when extracting hardlinks
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
https://github.com/python/cpython/commit/0367912be336348b30572f8029cec4a282782d92https://github.com/python/cpython/commit/5e0ef3f1afe892e4f64eb83368db57ac4c40cba0https://github.com/python/cpython/commit/7b57e8d51446297b8c7c482d224bc5f1938e4301https://github.com/python/cpython/commit/7ccdbaba2c54250a70d7f25632152df7655a5e0ahttps://github.com/python/cpython/commit/cf23b9153181062150d061468b6d24af33fe214fhttps://github.com/python/cpython/commit/d2b2f5eacab4dd48446b63340613b05dcbbf0b44https://github.com/python/cpython/commit/eee3ddf0ca10283cc7fea724aae9cd8665f8d15ehttps://github.com/python/cpython/issues/151987https://github.com/python/cpython/pull/151988https://mail.python.org/archives/list/[email protected]/thread/TWZW2PC2AZOV6FENIHFSRC63OM7MBGSB/
2026-06-30
Published