CVE-2026-82049
published 2026-09-14CVE-2026-82049: In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link…
PriorityP340high8.4CVSS 4.0
AVLACLATNPRNUIPVCHVIHVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.19%
7.9th percentile
In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | python3.11 | — | — |
| debian | python3.13 | — | — |
| debian | python3.14 | — | — |
| python_software_foundation | cpython | < 3.10.22 | 3.10.22 |
| python_software_foundation | cpython | >= 3.11.0 < 3.11.17 | 3.11.17 |
| python_software_foundation | cpython | >= 3.12.0 < 3.12.15 | 3.12.15 |
| python_software_foundation | cpython | >= 3.13.0 < 3.13.16 | 3.13.16 |
| python_software_foundation | cpython | >= 3.14.0a1 < 3.14.0b1 | 3.14.0b1 |
| ubuntu | python3.10 | — | — |
| ubuntu | python3.12 | — | — |
CVSS provenance
nvdv4.08.4HIGHCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.4HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
PSF CPython up to 3.14.0b0 Tarfile path traversal (EUVD-2026-77772 / Nessus ID 364204)
vuldb·2026-10-09·CVSS 8.4
CVE-2026-82049 [HIGH] PSF CPython up to 3.14.0b0 Tarfile path traversal (EUVD-2026-77772 / Nessus ID 364204)
A vulnerability was found in PSF CPython up to 3.14.0b0. It has been classified as critical. This vulnerability affects unknown code of the component Tarfile Module. This manipulation causes path traversal.
This vulnerability is handled as CVE-2026-82049. The attack can be initiated remotely. There is not any exploit available.
Upgrading the affected component is recommended.
GHSA
In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link.
ghsa_unreviewed·2026-09-14
CVE-2026-82049 [HIGH] CWE-59 In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link.
In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.
Red Hat
python: Python tarfile module: File modification and content disclosure via crafted archives
vendor_redhat·2026-09-14·CVSS 8.4
CVE-2026-82049 [HIGH] CWE-59 python: Python tarfile module: File modification and content disclosure via crafted archives
python: Python tarfile module: File modification and content disclosure via crafted archives
In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.
A flaw was found in Python's `tarfile` module. This module's data and tar extraction filters are vulnerable to specially crafted archives containing a hard link to a symbolic link. An attacker could exploit this by providing a malicious archive. This could lead to unauthorized modification of file permissions or modification times for files outside the
No detection rules found.
No public exploits indexed.
https://github.com/python/cpython/commit/197663d63afed27f66e10e23c194e8a634e60913https://github.com/python/cpython/commit/28f315486b3da0352b9a1de1c3c97f4127ba4771https://github.com/python/cpython/commit/5a57248b22ad3b9aafcaaadae2c304a1923daecahttps://github.com/python/cpython/commit/b38be2e6cf9d989075ab73412c63e003ebad4ff3https://github.com/python/cpython/commit/b8f23e307097552eaea2604383a12ab280520d0dhttps://github.com/python/cpython/commit/c66df4e70435d257fd488b35ea129c6f317433a8https://github.com/python/cpython/commit/cc1689830c6b9aaddded2fb9f2fe8116867e2c0ehttps://github.com/python/cpython/commit/cccc7ec30212dba2abef53ce4a2bed112ddb690chttps://github.com/python/cpython/issues/157190https://github.com/python/cpython/pull/157191https://mail.python.org/archives/list/[email protected]/thread/EFJWGAZJA56AKSBR2WHMHQZO7RRLZPRH/http://www.openwall.com/lists/oss-security/2026/09/14/27
2026-09-14
Published