Vulnerability · Published Sep 14, 2026 · Assigned by PSF
CVE-2026-82049tarfile extraction filters allow file modification and content disclosure via hard link to symlink
High 8.4
In plain English
A high-severity security flaw in CPython from Python Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.21 | python3 | 3.12.15-r0 | ALPINE-CVE-2026-82049 |
| Alpine:v3.22 | python3 | 3.12.15-r0 | ALPINE-CVE-2026-82049 |
| Alpine:v3.23 | python3 | 3.12.15-r0 | ALPINE-CVE-2026-82049 |
| Alpine:v3.24 | python3 | 3.14.8-r0 | ALPINE-CVE-2026-82049 |
| Debian:13 | pypy3 | no fix listed | DEBIAN-CVE-2026-82049 |
| Debian:14 | pypy3 | 8.0.1+dfsg-1 | DEBIAN-CVE-2026-82049 |
| Debian:13 | python3.13 | no fix listed | DEBIAN-CVE-2026-82049 |
| Ubuntu:22.04:LTS | pypy3 | no fix listed | UBUNTU-CVE-2026-82049 |
| Ubuntu:24.04:LTS | pypy3 | no fix listed | UBUNTU-CVE-2026-82049 |
| Ubuntu:26.04:LTS | pypy3 | no fix listed | UBUNTU-CVE-2026-82049 |
| Ubuntu:26.10 | pypy3 | no fix listed | UBUNTU-CVE-2026-82049 |
| Ubuntu:22.04:LTS | python3.10 | no fix listed | UBUNTU-CVE-2026-82049 |
| Ubuntu:24.04:LTS | python3.12 | no fix listed | UBUNTU-CVE-2026-82049 |
| Ubuntu:26.04:LTS | python3.14 | no fix listed | UBUNTU-CVE-2026-82049 |
| Ubuntu:26.10 | python3.14 | no fix listed | UBUNTU-CVE-2026-82049 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Python Software Foundation | CPython | 0 – before 3.10.223.11.0 – before 3.11.173.12.0 – before 3.12.153.13.0 – before 3.13.163.14.0a1 – before 3.14.0b1 |
Weakness: CWE-59 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/python/cpython/commit/5a57248b22ad3b9aafcaaadae2c304a1923daeca patch
- https://github.com/python/cpython/issues/157190 issue-tracking
- https://github.com/python/cpython/pull/157191 patch
- https://mail.python.org/archives/list/security-announce@python.org/thread/EFJWGAZJA56AKSBR2WHMHQZO7RRLZPRH/ vendor-advisory
- https://github.com/python/cpython/commit/b38be2e6cf9d989075ab73412c63e003ebad4ff3 patch
- https://github.com/python/cpython/commit/b8f23e307097552eaea2604383a12ab280520d0d patch
- https://github.com/python/cpython/commit/197663d63afed27f66e10e23c194e8a634e60913 patch
- https://github.com/python/cpython/commit/28f315486b3da0352b9a1de1c3c97f4127ba4771 patch
- https://github.com/python/cpython/commit/c66df4e70435d257fd488b35ea129c6f317433a8 patch
- https://github.com/python/cpython/commit/cc1689830c6b9aaddded2fb9f2fe8116867e2c0e patch
- https://github.com/python/cpython/commit/cccc7ec30212dba2abef53ce4a2bed112ddb690c patch
- http://www.openwall.com/lists/oss-security/2026/09/14/27