CVE-2026-87910CWE-22CWE-59path-traversal

CVE-2026-87910

published September 11, 2026

CVSS
5.7
EPSS
1%
Percentile
42.0
In the wild
Unconfirmed
What it is

When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.

The record
Technical detail
CVSS
5.7 · NONE
CVSS v4.0
5.7 · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00500 · 42.0th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published
2026-09-11T22:16Z
References (12)
https://github.com/python/cpython/commit/2eb0c2f1dc71847731b6ab30aebefd058d482a7f · [email protected]https://github.com/python/cpython/commit/3105a3498aaf681ce128cf5baf83c2e5574267c5 · [email protected]https://github.com/python/cpython/commit/764fd0af8d9e19d3684a58d2e58bf770f0605036 · [email protected]https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955 · [email protected]https://github.com/python/cpython/commit/a4919937a4e1e69a0d178909c6f20557eca5d1d0 · [email protected]https://github.com/python/cpython/commit/c1f106d240c4ffcb3608ed0a20e8aba6c865f6d3 · [email protected]https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b · [email protected]https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2 · [email protected]https://github.com/python/cpython/issues/157265 · [email protected]https://github.com/python/cpython/pull/157266 · [email protected]https://mail.python.org/archives/list/[email protected]/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/ · [email protected]http://www.openwall.com/lists/oss-security/2026/09/11/8 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 13 SEP 03:23Z
    EPSS moved — → 0%
    epss
  • 11 SEP 17:27Z
    tarfile hardlink fallback ignores custom extraction filter rejection via None
    cvelistv5