Description
The tarfile module's tar and data
extraction filters created directories outside the destination for
members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given.
Only
empty directories are created outside the destination. Member contents
are still extracted inside it. To return to the destination the member's
name must contain the destination directory's own final component, so
extraction into a secure randomised directory is not affected.
This affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Python Software Foundation | CPython | < 3.16.0 | 3.16.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python3.14 | 3.14.7-3 | — |
| Debian 14 | python3.15 | 3.15.0~rc2-1 | — |
| Debian 13 | python3.13 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | python3.14 | No fix yet | — |
| Ubuntu 26.04 LTS | python3.14 | No fix yet | — |
| Ubuntu 24.04 LTS | python3.12 | No fix yet | — |
| Ubuntu 22.04 LTS | python3.10 | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | python2.7 +1 | No fix yet | — |
| Ubuntu Pro 20.04 LTS | python2.7 +2 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | python2.7 +3 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | python2.7 +1 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | python2.7 +2 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | python3 +15 | 3.14.7-1.1.hum1 | RHSA-2026:65505 |
| Red Hat Hardened Images 1 | python3.10 +6 | 3.10.21-1.1.hum1 | RHSA-2026:65513 |
| Red Hat Hardened Images 1 | python3.11 +6 | 3.11.16-1.2.hum1 | RHSA-2026:65525 |
| Red Hat Hardened Images 1 | python3.12 +6 | 3.12.14-1.1.hum1 | RHSA-2026:65531 |
| Red Hat Hardened Images 1 | python3.13 +8 | 3.13.15-1.1.hum1 | RHSA-2026:65567 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | python +1 | 2.7.18-150000.133.1 | SUSE-SU-2026:4411-1 |
| SLES 15 SP7 | python3 +1 | 3.6.15-150300.10.129.1 | SUSE-SU-2026:4754-1 |
| SLES 15 SP7 | python311-core | 3.11.17-150600.3.74.1 | SUSE-SU-2026:4946-1 |
| SLES 15 SP6 | python3 +1 | 3.6.15-150300.10.129.1 | SUSE-SU-2026:4754-1 |
| SLES 15 SP6 | python311 +1 | 3.11.17-150600.3.74.1 | SUSE-SU-2026:4946-1 |
| SLES 15 SP6 | python312 +1 | 3.12.14-150600.3.68.1 | SUSE-SU-2026:4534-1 |
| SLES 15 SP5 | python3 +1 | 3.6.15-150300.10.129.1 | SUSE-SU-2026:4754-1 |
| SLES 15 SP5 | python311 +2 | 3.11.16-150400.9.102.1 | SUSE-SU-2026:4809-1, SUSE-SU-2026:4396-1 |
| SLES 15 SP4 | python3 +1 | 3.6.15-150300.10.129.1 | SUSE-SU-2026:4754-1 |
| SLES 15 SP4 | python310 +1 | 3.10.22-150400.4.129.1 | SUSE-SU-2026:4630-1 |
| SLES 15 SP4 | python311 +2 | 3.11.16-150400.9.102.1 | SUSE-SU-2026:4809-1, SUSE-SU-2026:4396-1 |
| SLES 12 SP5 | python +2 | 2.7.18-33.88.1 | SUSE-SU-2026:4633-1 |
| SLES 12 SP5 | python3 +1 | 3.4.10-25.199.1 | SUSE-SU-2026:4744-1 |
| SLES 12 SP5 | python36 +1 | 3.6.15-125.1 | SUSE-SU-2026:4743-1 |
Show 11 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 3 | python311 +1 | 3.11.17-150600.3.74.1 | SUSE-SU-2026:4946-1 |
| SLES 3 | python313 +1 | 3.13.16-150700.4.61.1 | SUSE-SU-2026:4941-1 |
| SLES for SAP 15 SP6 | python3 +1 | 3.6.15-150300.10.129.1 | SUSE-SU-2026:4754-1 |
| SLES for SAP 15 SP6 | python311 +1 | 3.11.17-150600.3.74.1 | SUSE-SU-2026:4946-1 |
| SLES for SAP 15 SP6 | python312 +1 | 3.12.14-150600.3.68.1 | SUSE-SU-2026:4534-1 |
| SLES for SAP 15 SP5 | python3 +1 | 3.6.15-150300.10.129.1 | SUSE-SU-2026:4754-1 |
| SLES for SAP 15 SP5 | python311 +2 | 3.11.16-150400.9.102.1 | SUSE-SU-2026:4809-1, SUSE-SU-2026:4396-1 |
| SLES for SAP 15 SP4 | python3 +1 | 3.6.15-150300.10.129.1 | SUSE-SU-2026:4754-1 |
| SLES for SAP 15 SP4 | python310 +1 | 3.10.22-150400.4.129.1 | SUSE-SU-2026:4630-1 |
| SLES for SAP 15 SP4 | python311 +2 | 3.11.16-150400.9.102.1 | SUSE-SU-2026:4809-1, SUSE-SU-2026:4396-1 |
| SLE Micro 6.1 | python311 +1 | 3.11.17-slfo.1.1_1.1 | SUSE-SU-2026:24280-1 |
| SLE Micro 6.0 | python311 +1 | 3.11.16-159998.1.1 | SUSE-SU-2026:24325-1, SUSE-SU-2026:24138-1 |
| SLE Micro 5.5 | python3 +1 | 3.6.15-150300.10.129.1 | SUSE-SU-2026:4754-1 |
| SLE Micro 5.4 | python3 +1 | 3.6.15-150300.10.129.1 | SUSE-SU-2026:4754-1 |
| SLE Micro 5.3 | python3 +1 | 3.6.15-150300.10.129.1 | SUSE-SU-2026:4754-1 |
| SLE HPC 15 SP5 | python3 +1 | 3.6.15-150300.10.129.1 | SUSE-SU-2026:4754-1 |
| SLE HPC 15 SP5 | python311 +2 | 3.11.16-150400.9.102.1 | SUSE-SU-2026:4809-1, SUSE-SU-2026:4396-1 |
| SLE HPC 15 SP4 | python3 +1 | 3.6.15-150300.10.129.1 | SUSE-SU-2026:4754-1 |
| SLE HPC 15 SP4 | python310 +1 | 3.10.22-150400.4.129.1 | SUSE-SU-2026:4630-1 |
| SLE HPC 15 SP4 | python311 +2 | 3.11.16-150400.9.102.1 | SUSE-SU-2026:4809-1, SUSE-SU-2026:4396-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python310 | 3.10.21-2.1 | openSUSE-SU-2026:11949-1 |
| openSUSE Tumbleweed | python311 | 3.11.16-2.1 | openSUSE-SU-2026:11886-1 |
| openSUSE Tumbleweed | python312 | 3.12.14-2.1 | openSUSE-SU-2026:11975-1 |
| openSUSE Tumbleweed | python313 | 3.13.15-1.1 | openSUSE-SU-2026:11817-1 |
| openSUSE Tumbleweed | python314 | 3.14.7-2.1 | openSUSE-SU-2026:11868-1 |
| openSUSE Tumbleweed | python315 | 3.15.0~rc2-1.1 | openSUSE-SU-2026:11748-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | python3 | 3.14.8-r0 | — |
| Alpine v3.23 | python3 | 3.12.15-r0 | — |
| Alpine v3.22 | python3 | 3.12.15-r0 | — |
| Alpine v3.21 | python3 | 3.12.15-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | python3.11 +6 | 3.11.17-1.amzn2023.0.1 | ALAS2023-2026-3231 |
| Amazon Linux 2023 | python3.12 +6 | 3.12.15-2.amzn2023.0.1 | ALAS2023-2026-3230 |
| Amazon Linux 2023 | python3.13 +8 | 3.13.16-1.amzn2023.0.1 | ALAS2023-2026-3229 |
| Amazon Linux 2023 | python3.14 +13 | 3.14.8-1.amzn2023.0.1 | ALAS2023-2026-3232 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python-py | No fix yet | — |
| Azure Linux 3 | python3 | 3.12.14-2 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | python-3.10 | 3.10.22-r1 | — |
| Wolfi rolling | python-3.11 | 3.11.17-r1 | — |
| Wolfi rolling | python-3.12 | 3.12.15-r1 | — |
| Wolfi rolling | python-3.13 | 3.13.16_git20261002-r0 | — |
| Wolfi rolling | python-3.14 | 3.14.7_git20260912-r0 | — |
Advisories 30
- SUSE-SU-2026:4946-1 Security update for python311 SUSE / openSUSE Security Updates · Oct 31, 2026
- SUSE-SU-2026:4941-1 Security update for python313 SUSE / openSUSE Security Updates · Oct 31, 2026
- WID-SEC-2026-3016 CPython: Schwachstelle ermöglicht Manipulation von Dateien BSI CERT-Bund (WID) · Oct 29, 2026
- SUSE-SU-2026:24325-1 Security update for python311 SUSE / openSUSE Security Updates · Oct 27, 2026
- SUSE-SU-2026:24280-1 Security update for python311 SUSE / openSUSE Security Updates · Oct 27, 2026
- ALAS2023-2026-3229 Important: python3.13 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 26, 2026
- ALAS2023-2026-3230 Important: python3.12 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 26, 2026
- ALAS2023-2026-3231 Important: python3.11 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 26, 2026
- ALAS2023-2026-3232 Important: python3.14 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 26, 2026
- SUSE-SU-2026:4809-1 Security update for python311 SUSE / openSUSE Security Updates · Oct 21, 2026
- SUSE-SU-2026:4754-1 Security update for python3 SUSE / openSUSE Security Updates · Oct 21, 2026
- SUSE-SU-2026:4744-1 Security update for python3, python3-base, python3-doc SUSE / openSUSE Security Updates · Oct 20, 2026
- SUSE-SU-2026:4743-1 Security update for python36 SUSE / openSUSE Security Updates · Oct 20, 2026
- RHSA-2026:65525 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:65505 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:65531 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:65567 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:65513 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- SUSE-SU-2026:24138-1 Security update for python311 SUSE / openSUSE Security Updates · Oct 15, 2026
- SUSE-SU-2026:4633-1 Security update for python SUSE / openSUSE Security Updates · Oct 13, 2026
- SUSE-SU-2026:4630-1 Security update for python310 SUSE / openSUSE Security Updates · Oct 13, 2026
- SUSE-SU-2026:4534-1 Security update for python312 SUSE / openSUSE Security Updates · Oct 6, 2026
- openSUSE-SU-2026:11975-1 python312-3.12.14-2.1 on GA media SUSE / openSUSE Security Updates · Oct 3, 2026
- openSUSE-SU-2026:11949-1 python310-3.10.21-2.1 on GA media SUSE / openSUSE Security Updates · Oct 2, 2026
- SUSE-SU-2026:4411-1 Security update for python SUSE / openSUSE Security Updates · Oct 2, 2026
- SUSE-SU-2026:4396-1 Security update for python311 SUSE / openSUSE Security Updates · Sep 30, 2026
- openSUSE-SU-2026:11886-1 python311-3.11.16-2.1 on GA media SUSE / openSUSE Security Updates · Sep 25, 2026
- openSUSE-SU-2026:11868-1 python314-3.14.7-2.1 on GA media SUSE / openSUSE Security Updates · Sep 24, 2026
- openSUSE-SU-2026:11817-1 python313-3.13.15-1.1 on GA media SUSE / openSUSE Security Updates · Sep 19, 2026
- openSUSE-SU-2026:11748-1 python315-3.15.0~rc2-1.1 on GA media SUSE / openSUSE Security Updates · Sep 11, 2026