Log in Start free

Vulnerability · Published Oct 22, 2026 · Assigned by PSF

CVE-2026-114583tar filter allows writing outside destination via empty-named symlink

Medium 6.9

In plain English

A medium-severity path traversal in CPython from Python Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.9Medium
Exploit odds (30 days)0.3%top 82.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter="tar" to write files outside the destination directory, subject to the permissions of the extracting process. This is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.21python33.12.16-r0ALPINE-CVE-2026-114583
Alpine:v3.22python33.12.16-r0ALPINE-CVE-2026-114583
Alpine:v3.23python33.12.16-r0ALPINE-CVE-2026-114583
Alpine:v3.24python33.14.10-r0ALPINE-CVE-2026-114583
Debian:12jythonno fix listedDEBIAN-CVE-2026-114583
Debian:13jythonno fix listedDEBIAN-CVE-2026-114583
Debian:14jythonno fix listedDEBIAN-CVE-2026-114583
Debian:12pypy3no fix listedDEBIAN-CVE-2026-114583
Debian:13pypy3no fix listedDEBIAN-CVE-2026-114583
Debian:14pypy3no fix listedDEBIAN-CVE-2026-114583
Debian:12python3.11no fix listedDEBIAN-CVE-2026-114583
Debian:13python3.13no fix listedDEBIAN-CVE-2026-114583
Debian:14python3.143.14.9-1DEBIAN-CVE-2026-114583
Debian:14python3.153.15.1-1DEBIAN-CVE-2026-114583
Ubuntu:22.04:LTSpython3.10no fix listedUBUNTU-CVE-2026-114583
Ubuntu:24.04:LTSpython3.12no fix listedUBUNTU-CVE-2026-114583
Ubuntu:26.04:LTSpython3.14no fix listedUBUNTU-CVE-2026-114583
Ubuntu:26.10python3.14no fix listedUBUNTU-CVE-2026-114583
Ubuntu:26.10python3.15no fix listedUBUNTU-CVE-2026-114583

Affected products (as reported)

VendorProductVersions
Python Software Foundation CPython 0 – before 3.11.183.12.0 – before 3.12.163.13.0 – before 3.13.183.14.0 – before 3.14.103.15.0 – before 3.15.23.16.0a1 – before 3.16.0

Weakness: CWE-22 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References