Vulnerability Description
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Python | Python | < 3.1.5 |
Related Weaknesses (CWE)
References
- https://github.com/python/cpython/commit/0367912be336348b30572f8029cec4a282782d9
- https://github.com/python/cpython/commit/5e0ef3f1afe892e4f64eb83368db57ac4c40cbaPatch
- https://github.com/python/cpython/commit/7b57e8d51446297b8c7c482d224bc5f1938e430Patch
- https://github.com/python/cpython/commit/7ccdbaba2c54250a70d7f25632152df7655a5e0Patch
- https://github.com/python/cpython/commit/cf23b9153181062150d061468b6d24af33fe214
- https://github.com/python/cpython/commit/d2b2f5eacab4dd48446b63340613b05dcbbf0b4Patch
- https://github.com/python/cpython/commit/eee3ddf0ca10283cc7fea724aae9cd8665f8d15Patch
- https://github.com/python/cpython/issues/151987Issue TrackingPatch
- https://github.com/python/cpython/pull/151988Issue TrackingPatch
- https://mail.python.org/archives/list/[email protected]/thread/TWZW2PIssue TrackingVendor Advisory
FAQ
What is CVE-2026-4360?
CVE-2026-4360 is a vulnerability with a CVSS score of 5.3 (MEDIUM). In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files w...
How severe is CVE-2026-4360?
CVE-2026-4360 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-4360?
Check the references section above for vendor advisories and patch information. Affected products include: Python Python.