p PatchFirst

CVE-2026-4360

CVE-2026-4360 · Tarfile.extract() doesn't fully respect filter parameter

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.

CVSS 2.0 · Low · EPSS 0.5% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • python

    Versions
    • ≥ 0, < 3.10.21: Affected (python)
    • ≥ 3.11.0, < 3.11.16: Affected (python)
    • ≥ 3.12.0, < 3.12.14: Affected (python)
    • ≥ 3.13.0, < 3.13.15: Affected (python)
    • ≥ 3.14.0, < 3.14.7: Affected (python)
    • ≥ 3.15.0a1, < 3.15.0b4: Affected (python)

    Update to 3.10.21; Update to 3.11.16; Update to 3.12.14; Update to 3.13.15; Update to 3.14.7; Update to 3.15.0b4

  • pypy3 Debian:13

    Versions
    • 7.3.19+dfsg-2
    • 7.3.20+dfsg-1
    • 7.3.20+dfsg-2
    • 7.3.20+dfsg-3
    • 7.3.20+dfsg-4
    • 7.3.21+dfsg-1
    • 7.3.21+dfsg-2
    • 7.3.21+dfsg-3
    • 7.3.21+dfsg-4
    • 7.3.22+dfsg-1
    • 7.3.23+dfsg-1
    • 7.3.23+dfsg-2
    • 8.0.0+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pypy3 Debian:14

    Versions
    • 7.3.19+dfsg-2
    • 7.3.20+dfsg-1
    • 7.3.20+dfsg-2
    • 7.3.20+dfsg-3
    • 7.3.20+dfsg-4
    • 7.3.21+dfsg-1
    • 7.3.21+dfsg-2
    • 7.3.21+dfsg-3
    • 7.3.21+dfsg-4
    • 7.3.22+dfsg-1
    • 7.3.23+dfsg-1
    • 7.3.23+dfsg-2
    Affected ranges
    • ECOSYSTEM: < 8.0.0+dfsg-1

    Update to 8.0.0+dfsg-1

  • python3.13 Debian:13

    Versions
    • 3.13.5-2
    • 3.13.5-2+deb13u1
    • 3.13.5-2+deb13u2
    • 3.13.5-2+deb13u3
    • 3.13.5-2+deb13u4
    Affected ranges
    • ECOSYSTEM: < 3.13.5-2+deb13u5

    Update to 3.13.5-2+deb13u5

  • python3.13 Debian:14

    Versions
    • 3.13.11-1
    • 3.13.12-1
    • 3.13.14-1
    • 3.13.5-2
    • 3.13.6-1
    • 3.13.7-1
    • 3.13.8-1
    • 3.13.9-1
    Affected ranges
    • ECOSYSTEM: < 3.13.15-1

    Update to 3.13.15-1

  • python3.14 Debian:14

    Versions
    • 3.14.0-1
    • 3.14.0-2
    • 3.14.0-3
    • 3.14.0-4
    • 3.14.0-5
    • 3.14.0~a7-1
    • 3.14.0~b1-1
    • 3.14.0~b2-1
    • 3.14.0~b3-1
    • 3.14.0~b4-1
    • 3.14.0~rc1-1
    • 3.14.0~rc2-1
    • 3.14.0~rc3-1
    • 3.14.2-1
    • 3.14.3-1
    • 3.14.3-2
    • 3.14.3-3
    • 3.14.3-4
    • 3.14.3-5
    • 3.14.4-1
    • 3.14.4-2
    • 3.14.5-1
    • 3.14.5~rc1-1
    • 3.14.6-1
    Affected ranges
    • ECOSYSTEM: < 3.14.7-1

    Update to 3.14.7-1

  • python3.10 Ubuntu:22.04:LTS

    Versions
    • 3.10.0-2
    • 3.10.0-3
    • 3.10.0-4
    • 3.10.0-5
    • 3.10.0-5build1
    • 3.10.1-1
    • 3.10.1-2
    • 3.10.2-1
    • 3.10.2-5
    • 3.10.2-7
    • 3.10.3-1
    • 3.10.4-3
    • 3.10.4-3ubuntu0.1
    • 3.10.6-1~22.04
    • 3.10.6-1~22.04.1
    • 3.10.6-1~22.04.2
    • 3.10.6-1~22.04.2ubuntu1
    • 3.10.6-1~22.04.2ubuntu1.1
    • 3.10.12-1~22.04.2
    • 3.10.12-1~22.04.3
    • 3.10.12-1~22.04.4
    • 3.10.12-1~22.04.5
    • 3.10.12-1~22.04.6
    • 3.10.12-1~22.04.7
    • 3.10.12-1~22.04.8
    • 3.10.12-1~22.04.9
    • 3.10.12-1~22.04.10
    • 3.10.12-1~22.04.11
    • 3.10.12-1~22.04.12
    • 3.10.12-1~22.04.13
    • 3.10.12-1~22.04.14
    • 3.10.12-1~22.04.15
    • 3.10.12-1~22.04.16
    • 3.10.12-1~22.04.17
    Affected ranges
    • ECOSYSTEM: < 3.10.12-1~22.04.18

    Update to 3.10.12-1~22.04.18

  • python3.12 Ubuntu:24.04:LTS

    Versions
    • 3.12.0-1
    • 3.12.0-5
    • 3.12.0-6
    • 3.12.0-7
    • 3.12.1-2
    • 3.12.2-1
    • 3.12.2-4build3
    • 3.12.2-4build4
    • 3.12.2-5ubuntu3
    • 3.12.3-1
    • 3.12.3-1ubuntu0.1
    • 3.12.3-1ubuntu0.2
    • 3.12.3-1ubuntu0.3
    • 3.12.3-1ubuntu0.4
    • 3.12.3-1ubuntu0.5
    • 3.12.3-1ubuntu0.6
    • 3.12.3-1ubuntu0.7
    • 3.12.3-1ubuntu0.8
    • 3.12.3-1ubuntu0.9
    • 3.12.3-1ubuntu0.10
    • 3.12.3-1ubuntu0.11
    • 3.12.3-1ubuntu0.12
    • 3.12.3-1ubuntu0.13
    • 3.12.3-1ubuntu0.15
    • 3.12.3-1ubuntu0.16
    Affected ranges
    • ECOSYSTEM: < 3.12.3-1ubuntu0.17

    Update to 3.12.3-1ubuntu0.17

  • python3.13 Ubuntu:25.10

    Versions
    • 3.13.3-1
    • 3.13.3-2
    • 3.13.3-4
    • 3.13.4-1
    • 3.13.5-1
    • 3.13.5-2
    • 3.13.6-1
    • 3.13.7-1
    • 3.13.7-1ubuntu0.1
    • 3.13.7-1ubuntu0.2
    • 3.13.7-1ubuntu0.3
    • 3.13.7-1ubuntu0.4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python3.14 Ubuntu:25.10

    Versions
    • 3.14.0~a7-0ubuntu1
    • 3.14.0~b1-1
    • 3.14.0~b3-1
    • 3.14.0~rc1-1
    • 3.14.0~rc2-1
    • 3.14.0~rc3-1
    • 3.14.0-1
    • 3.14.0-1ubuntu0.1
    • 3.14.0-1ubuntu0.2
    • 3.14.0-1ubuntu0.3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python3.14 Ubuntu:26.04:LTS

    Versions
    • 3.14.0-1
    • 3.14.0-2
    • 3.14.0-4
    • 3.14.2-1
    • 3.14.3-1
    • 3.14.3-2
    • 3.14.3-3
    • 3.14.3-5
    • 3.14.4-1
    • 3.14.4-1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: < 3.14.4-1ubuntu0.2

    Update to 3.14.4-1ubuntu0.2

Original sources

Check your server →