CVE-2026-4360CWE-281

CVE-2026-4360

Medium · published June 30, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
40.5
In the wild
Unconfirmed
What it is

In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00481 · 40.5th percentile
Weakness
CWE-281 · Improper Preservation of Permissions
Published
2026-06-30T19:16Z
Affected products (1)
ProductVersionsFixed in
python/python< 3.1.53.1.5
References (10)
https://github.com/python/cpython/commit/0367912be336348b30572f8029cec4a282782d92 · [email protected]https://github.com/python/cpython/commit/5e0ef3f1afe892e4f64eb83368db57ac4c40cba0 · [email protected]https://github.com/python/cpython/commit/7b57e8d51446297b8c7c482d224bc5f1938e4301 · [email protected]https://github.com/python/cpython/commit/7ccdbaba2c54250a70d7f25632152df7655a5e0a · [email protected]https://github.com/python/cpython/commit/cf23b9153181062150d061468b6d24af33fe214f · [email protected]https://github.com/python/cpython/commit/d2b2f5eacab4dd48446b63340613b05dcbbf0b44 · [email protected]https://github.com/python/cpython/commit/eee3ddf0ca10283cc7fea724aae9cd8665f8d15e · [email protected]https://github.com/python/cpython/issues/151987 · [email protected]https://github.com/python/cpython/pull/151988 · [email protected]https://mail.python.org/archives/list/[email protected]/thread/TWZW2PC2AZOV6FENIHFSRC63OM7MBGSB/ · [email protected]
EPSS history
Timeline
  • 30 JUN 14:45Z
    Tarfile.extract() doesn't fully respect filter parameter
    cvelistv5