CVE search · CVE-2026-4360
CVE-2026-4360
low 2.0
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
Details
- Status
- Modified
- Published
- Last changed
- Source
- cna@python.org
- Weakness
- CWE-281
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 4.0 | low 2.0 | CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
cna@python.orgSecondary |
| CVSS 3.1 | medium 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
nvd@nist.govPrimary |
Affected products
Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.
- python · python
References
- https://github.com/python/cpython/commit/0367912be336348b30572f8029cec4a282782d92
- https://github.com/python/cpython/commit/5e0ef3f1afe892e4f64eb83368db57ac4c40cba0Patch
- https://github.com/python/cpython/commit/7b57e8d51446297b8c7c482d224bc5f1938e4301Patch
- https://github.com/python/cpython/commit/7ccdbaba2c54250a70d7f25632152df7655a5e0aPatch
- https://github.com/python/cpython/commit/cf23b9153181062150d061468b6d24af33fe214f
- https://github.com/python/cpython/commit/d2b2f5eacab4dd48446b63340613b05dcbbf0b44Patch
- https://github.com/python/cpython/commit/eee3ddf0ca10283cc7fea724aae9cd8665f8d15ePatch
- https://github.com/python/cpython/issues/151987Issue TrackingPatch
- https://github.com/python/cpython/pull/151988Issue TrackingPatch
- https://mail.python.org/archives/list/security-announce@python.org/thread/TWZW2PC2AZOV6FENIHFSRC63OM7MBGSB/Issue TrackingVendor Advisory