p PatchFirst

ALPINE-CVE-2026-82049

ALPINE-CVE-2026-82049

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.

CVSS 8.4 · High · Fix available

Published
Updated

Stack: system

Affected products and versions

  • python3 Alpine:v3.21

    Affected ranges
    • ECOSYSTEM: < 3.12.15-r0

    Update to 3.12.15-r0

  • python3 Alpine:v3.22

    Affected ranges
    • ECOSYSTEM: < 3.12.15-r0

    Update to 3.12.15-r0

  • python3 Alpine:v3.23

    Affected ranges
    • ECOSYSTEM: < 3.12.15-r0

    Update to 3.12.15-r0

  • python3 Alpine:v3.24

    Affected ranges
    • ECOSYSTEM: < 3.14.8-r0

    Update to 3.14.8-r0

Original sources

Check your server →