CVE-2026-11940
HighCVSS 7.8Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
The tarfile.extractall() function with the 'data' or 'tar' filter can be bypassed by a crafted archive where a hardlink references a symlink stored deeper than the hardlink itself. This allows creating a symlink pointing outside the destination directory, enabling out-of-destination file reads or writes. This is an incomplete fix of CVE-2025-4330.
Risk Assessment
An attacker can supply a malicious tar archive that, when extracted, can overwrite or read files outside the destination directory, potentially leading to system integrity compromise or data leakage.
Recommendation
Upgrade the tarfile library (Python) to the latest version that includes a complete fix for this vulnerability. Also avoid using the 'data' and 'tar' filters with untrusted archives.
Other vulnerabilities in Python tarfile
See all- CVE-2026-19672Medium
The tarfile module in Python has a vulnerability in its extraction filters that allows creating directories outside the destination for members whose name leaves the destination and returns to it (e.g., ../evil/../dest/sub/file). The issue affects only POSIX platforms and creates only empty directories outside the destination.
- CVE-2025-8194High
A defect in CPython's tarfile module affects TarFile extraction and entry enumeration APIs. Tar archives with negative offsets cause an infinite loop and deadlock during parsing of malicious archives.
- CVE-2025-4330High
Vulnerability in Python's tarfile module allows the extraction filter to be ignored, enabling symlink targets to point outside the destination directory and modification of file metadata. Affects TarFile.extractall() or TarFile.extract() with filter='data' or 'tar'.
Original NVD description (English source)
tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory. This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330.