Vulnerability · Published Sep 11, 2026 · Assigned by PSF
CVE-2026-87910tarfile hardlink fallback ignores custom extraction filter rejection via None
Medium 5.7
In plain English
A medium-severity path traversal in CPython from Python Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.21 | python3 | 3.12.15-r0 | ALPINE-CVE-2026-87910 |
| Alpine:v3.22 | python3 | 3.12.15-r0 | ALPINE-CVE-2026-87910 |
| Alpine:v3.23 | python3 | 3.12.15-r0 | ALPINE-CVE-2026-87910 |
| Debian:13 | pypy3 | no fix listed | DEBIAN-CVE-2026-87910 |
| Debian:14 | pypy3 | 8.0.1+dfsg-1 | DEBIAN-CVE-2026-87910 |
| Debian:13 | python3.13 | no fix listed | DEBIAN-CVE-2026-87910 |
| Debian:14 | python3.14 | 3.14.9-1 | DEBIAN-CVE-2026-87910 |
| Debian:14 | python3.15 | 3.15.0~rc3-1 | DEBIAN-CVE-2026-87910 |
| Ubuntu:22.04:LTS | pypy3 | no fix listed | UBUNTU-CVE-2026-87910 |
| Ubuntu:24.04:LTS | pypy3 | no fix listed | UBUNTU-CVE-2026-87910 |
| Ubuntu:26.04:LTS | pypy3 | no fix listed | UBUNTU-CVE-2026-87910 |
| Ubuntu:26.10 | pypy3 | no fix listed | UBUNTU-CVE-2026-87910 |
| Ubuntu:22.04:LTS | python3.10 | no fix listed | UBUNTU-CVE-2026-87910 |
| Ubuntu:24.04:LTS | python3.12 | no fix listed | UBUNTU-CVE-2026-87910 |
| Ubuntu:26.04:LTS | python3.14 | no fix listed | UBUNTU-CVE-2026-87910 |
| Ubuntu:26.10 | python3.14 | no fix listed | UBUNTU-CVE-2026-87910 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Python Software Foundation | CPython | 0 – before 3.10.223.11.0 – before 3.11.173.12.0 – before 3.12.153.13.0 – before 3.13.163.14.0 – before 3.14.93.15.0a1 – before 3.15.0rc3 |
Weakness: CWE-22, CWE-59 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
References
- https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/ vendor-advisory
- https://github.com/python/cpython/pull/157266 patch
- https://github.com/python/cpython/issues/157265 issue-tracking
- https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b patch
- https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2 patch
- https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955 patch
- https://github.com/python/cpython/commit/764fd0af8d9e19d3684a58d2e58bf770f0605036 patch
- https://github.com/python/cpython/commit/2eb0c2f1dc71847731b6ab30aebefd058d482a7f patch
- https://github.com/python/cpython/commit/c1f106d240c4ffcb3608ed0a20e8aba6c865f6d3 patch
- https://github.com/python/cpython/commit/3105a3498aaf681ce128cf5baf83c2e5574267c5 patch
- https://github.com/python/cpython/commit/a4919937a4e1e69a0d178909c6f20557eca5d1d0 patch
- http://www.openwall.com/lists/oss-security/2026/09/11/8