Description
tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter="tar" to write files outside the destination directory, subject to the permissions of the extracting process.
This is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Python Software Foundation | CPython | < 3.11.18, 3.12.0 – < 3.12.16, 3.13.0 – < 3.13.18, 3.14.0 – < 3.14.10, 3.15.0 – < 3.15.2, 3.16.0a1 – < 3.16.0 | 3.11.18 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pypy3 +1 | No fix yet | — |
| Debian 14 | python3.14 | 3.14.9-1 | — |
| Debian 14 | python3.15 | 3.15.1-1 | — |
| Debian 13 | pypy3 +2 | No fix yet | — |
| Debian 12 | pypy3 +2 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | python3.14 +1 | No fix yet | — |
| Ubuntu 26.04 LTS | python3.14 | No fix yet | — |
| Ubuntu 24.04 LTS | python3.12 | No fix yet | — |
| Ubuntu 22.04 LTS | python3.10 | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | python2.7 +1 | No fix yet | — |
| Ubuntu Pro 20.04 LTS | python2.7 +2 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | python2.7 +3 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | python2.7 +1 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | python2.7 +2 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | python3 +8 | 3.9.25-14.el9_9 | RHSA-2026:98511 |
| RHEL 8 | python3 +7 | 3.6.8-80.el8_10 | RHSA-2026:99691 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | python3 +15 | 3.14.10-1.hum1 | RHSA-2026:92066 |
| Red Hat Hardened Images 1 | python3.11 +6 | 3.11.18-1.hum1 | RHSA-2026:90986 |
| Red Hat Hardened Images 1 | python3.12 +6 | 3.12.16-1.hum1 | RHSA-2026:90533 |
| Red Hat Hardened Images 1 | python3.13 +8 | 3.13.18-1.hum1 | RHSA-2026:90995 |
| Red Hat Hardened Images 1 | python3.15 +13 | 3.15.2-0.1.hum1 | RHSA-2026:90305 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python315 | 3.15.2-1.1 | openSUSE-SU-2026:12348-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | python3 | 3.14.10-r0 | — |
| Alpine v3.23 | python3 | 3.12.16-r0 | — |
| Alpine v3.22 | python3 | 3.12.16-r0 | — |
| Alpine v3.21 | python3 | 3.12.16-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | python3.11 +6 | 3.11.18-1.amzn2023.0.1 | ALAS2023-2026-3356 |
| Amazon Linux 2023 | python3.12 +6 | 3.12.16-2.amzn2023.0.1 | ALAS2023-2026-3408 |
| Amazon Linux 2023 | python3.13 +8 | 3.13.18-1.amzn2023.0.1 | ALAS2023-2026-3407 |
| Amazon Linux 2023 | python3.14 +13 | 3.14.10-1.amzn2023.0.1 | ALAS2023-2026-3406 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python-py +1 | No fix yet | — |
| Azure Linux 3 | python3 | 3.12.16-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | python3-idle +6 | 3.6.8-80.0.1.el8_10 | ELSA-2026-99691 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | python-3.10 | No fix yet | — |
| Wolfi rolling | python-3.13 | 3.13.18_git20261030-r0 | — |
| Wolfi rolling | python-3.14 | 3.14.10_git20261028-r0 | — |
| Wolfi rolling | python-3.15 | 3.15.2_git20261030-r0 | — |
Advisories 14
- RHSA-2026:98511 Red Hat Security Advisory: python3.9 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:99691 Red Hat Security Advisory: python3 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:92066 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:90995 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:90986 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:90533 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:90305 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- ELSA-2026-99691 Moderate: python3 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 13, 2026
- WID-SEC-2026-4189 Python: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- ALAS2023-2026-3406 Moderate: python3.14 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 9, 2026
- ALAS2023-2026-3407 Moderate: python3.13 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 9, 2026
- ALAS2023-2026-3408 Moderate: python3.12 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 9, 2026
- ALAS2023-2026-3356 Moderate: python3.11 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 2, 2026
- openSUSE-SU-2026:12348-1 python315-3.15.2-1.1 on GA media SUSE / openSUSE Security Updates · Oct 31, 2026
References
- https://github.com/python/cpython/pull/160098 patch
- https://github.com/python/cpython/issues/160097 issue-tracking
- https://mail.python.org/archives/list/security-announce@python.org/thread/43JOWPRAV5DI3VZ4FUEUAZOHCATXXOCK/
- https://github.com/python/cpython/commit/0901ad4ffb22605f12b705d1c1197f0a01f0ba0b patch
- https://github.com/python/cpython/commit/c6ada40177436e4e2533a7b252082b5f0c043477 patch
- https://github.com/python/cpython/commit/e7e0b3523ad6ba8472873dda594cf4021a16f8b5 patch
- https://github.com/python/cpython/commit/04d8fca7da2cf3ebc0881fec8a53a1330c3b665d patch
- https://github.com/python/cpython/commit/bc93f8ad4c4a0f92d184ec8fccc8ff8a651dcec2 patch
- https://github.com/python/cpython/commit/f4401da82e2baec5dab06cf070fbca77d53220f0 patch