CVE-2026-87910
published 2026-09-11CVE-2026-87910: When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function…
PriorityP429medium5.7CVSS 4.0
AVNACLATPPRLUIAVCNVIHVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.50%
42.0th percentile
When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | python3.11 | — | — |
| debian | python3.13 | — | — |
| debian | python3.14 | — | — |
| python_software_foundation | cpython | < 3.10.22 | 3.10.22 |
| python_software_foundation | cpython | >= 3.11.0 < 3.11.17 | 3.11.17 |
| python_software_foundation | cpython | >= 3.12.0 < 3.12.15 | 3.12.15 |
| python_software_foundation | cpython | >= 3.13.0 < 3.13.16 | 3.13.16 |
| python_software_foundation | cpython | >= 3.14.0 < 3.14.9 | 3.14.9 |
| python_software_foundation | cpython | >= 3.15.0a1 < 3.15.0rc3 | 3.15.0rc3 |
CVSS provenance
nvdv4.05.7MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat5.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
python: Python tarfile module: Security filter bypass allows arbitrary file write
vendor_redhat·2026-09-11·CVSS 5.7
CVE-2026-87910 [MEDIUM] CWE-252 python: Python tarfile module: Security filter bypass allows arbitrary file write
python: Python tarfile module: Security filter bypass allows arbitrary file write
A flaw was found in the Python `tarfile` module. When extracting an archive containing a link on systems that do not support links, the module falls back to extracting the linked member. During this fallback, a security filter designed to prevent the extraction of certain files is not properly applied. This oversight could allow an attacker to bypass intended security restrictions, potentially leading to the creation or modification of arbitrary files on the system.
Package: hi/python (Red Hat Hardened Images) - Not affected
Package: python3.10 (Red Hat Hardened Images) - Affected
Package: python3.11 (Red Hat Hardened Images) - Affected
Package: python3.12 (Red Hat Hardened Images) - Affected
Package: p
VulDB
Python up to 3.15.x filter return value (EUVD-2026-76162 / WID-SEC-2026-3335)
vuldb·2026-10-01·CVSS 5.7
CVE-2026-87910 [MEDIUM] Python up to 3.15.x filter return value (EUVD-2026-76162 / WID-SEC-2026-3335)
A vulnerability identified as critical has been detected in Python up to 3.15.x. This affects the function filter. This manipulation causes unchecked return value.
This vulnerability is handled as CVE-2026-87910. The attack can be initiated remotely. There is not any exploit available.
You should upgrade the affected component.
GHSA
When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive.
ghsa_unreviewed·2026-09-11
CVE-2026-87910 [MEDIUM] CWE-22 When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive.
When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.
No detection rules found.
No public exploits indexed.
https://github.com/python/cpython/commit/2eb0c2f1dc71847731b6ab30aebefd058d482a7fhttps://github.com/python/cpython/commit/3105a3498aaf681ce128cf5baf83c2e5574267c5https://github.com/python/cpython/commit/764fd0af8d9e19d3684a58d2e58bf770f0605036https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955https://github.com/python/cpython/commit/a4919937a4e1e69a0d178909c6f20557eca5d1d0https://github.com/python/cpython/commit/c1f106d240c4ffcb3608ed0a20e8aba6c865f6d3https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57bhttps://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2https://github.com/python/cpython/issues/157265https://github.com/python/cpython/pull/157266https://mail.python.org/archives/list/[email protected]/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/http://www.openwall.com/lists/oss-security/2026/09/11/8
2026-09-11
Published