VulnerabilityModified
CVE-2026-4360
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks.
LOW 2.0EPSS 0.28%
Does this matter?
Lower severity and a low EPSS score (0.28%). Track it; it rarely justifies an emergency change on its own.
Description
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
- CVSS 4.0
- 2.0 LOWCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.28% probability · 20th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-281
- Affected
- python/python
- Source
- cna@python.org
References
- https://github.com/python/cpython/commit/0367912be336348b30572f8029cec4a282782d92
- https://github.com/python/cpython/commit/5e0ef3f1afe892e4f64eb83368db57ac4c40cba0Patch
- https://github.com/python/cpython/commit/7b57e8d51446297b8c7c482d224bc5f1938e4301Patch
- https://github.com/python/cpython/commit/7ccdbaba2c54250a70d7f25632152df7655a5e0aPatch
- https://github.com/python/cpython/commit/cf23b9153181062150d061468b6d24af33fe214f
- https://github.com/python/cpython/commit/d2b2f5eacab4dd48446b63340613b05dcbbf0b44Patch
- https://github.com/python/cpython/commit/eee3ddf0ca10283cc7fea724aae9cd8665f8d15ePatch
- https://github.com/python/cpython/issues/151987Issue Tracking, Patch
- https://github.com/python/cpython/pull/151988Issue Tracking, Patch
- https://mail.python.org/archives/list/security-announce@python.org/thread/TWZW2PC2AZOV6FENIHFSRC63OM7MBGSB/Issue Tracking, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.