vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-82049

tarfile extraction filters allow file modification and content disclosure via hard link to symlink

HIGH
8.4
CVSS Score
Published: September 14, 2026 at 07:14 PM UTC
Updated: October 11, 2026 at 01:16 AM UTC
1 product affected across 1 vendorPython

Using CPython by Python Software Foundation?

Get instant alerts when new vulnerabilities affect CPython - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH8.4
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Python· Python
90%
03.11.03.12.03.13.03.14.0a1
Affected range stops below 3.10.22, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.11.17, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.12.15, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.13.16, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.14.0b1, so it looks safe — our inference, not a vendor statement

References (12)

Patch
Source: cverecord
https://github.com/python/cpython/commit/5a57248b22ad3b9aafcaaadae2c304a1923daeca
Issue Tracking
Source: cverecord
https://github.com/python/cpython/issues/157190
Patch
Source: cverecord
https://github.com/python/cpython/pull/157191
Vendor Advisory
Source: cverecord
https://mail.python.org/archives/list/[email protected]/thread/EFJWGAZJA56AKSBR2WHMHQZO7RRLZPRH/
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.openwall.com/lists/oss-security/2026/09/14/27
Patch
Source: cverecord
https://github.com/python/cpython/commit/b38be2e6cf9d989075ab73412c63e003ebad4ff3
Patch
Source: cverecord
https://github.com/python/cpython/commit/b8f23e307097552eaea2604383a12ab280520d0d
Patch
Source: cverecord
https://github.com/python/cpython/commit/197663d63afed27f66e10e23c194e8a634e60913

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

8.4HIGHPSF
Vector?

Quick Info

StatusAWAITING ANALYSIS
CWE
CWE-59

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card