CVE-2026-4360
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Tarfile.extract() doesn't fully respect filter parameter
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
CPython
- Vendor
- Python Software Foundation
- Product
- CPython
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0 | affected | python | 3.10.21 | Unavailable | None listed |
| 3.11.0 | affected | python | 3.11.16 | Unavailable | None listed |
| 3.12.0 | affected | python | 3.12.14 | Unavailable | None listed |
| 3.13.0 | affected | python | 3.13.15 | Unavailable | None listed |
| 3.14.0 | affected | python | 3.14.7 | Unavailable | None listed |
| 3.15.0a1 | affected | python | 3.15.0b4 | Unavailable | None listed |