Vulnerability Description
In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.
Related Weaknesses (CWE)
References
- https://github.com/python/cpython/commit/5a57248b22ad3b9aafcaaadae2c304a1923daec
- https://github.com/python/cpython/commit/b38be2e6cf9d989075ab73412c63e003ebad4ff
- https://github.com/python/cpython/commit/b8f23e307097552eaea2604383a12ab280520d0
- https://github.com/python/cpython/issues/157190
- https://github.com/python/cpython/pull/157191
- https://mail.python.org/archives/list/[email protected]/thread/EFJWGA
- http://www.openwall.com/lists/oss-security/2026/09/14/27
FAQ
What is CVE-2026-82049?
CVE-2026-82049 is a documented vulnerability. In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to mo...
How severe is CVE-2026-82049?
CVSS scoring is not yet available for CVE-2026-82049. Check NVD for updates.
Is there a patch for CVE-2026-82049?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.