CVE-2026-7774
CVE-2026-7774 · tarfile.data_filter path traversal bypass allows writing outside the extraction directory
This page contains facts from public vulnerability sources. Check the original advisory before updating.
tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process.
CVSS 6.9 · Medium · EPSS 0.8% · Fix available
- Published
- Updated
Affected products and versions
python
- Versions
- ≥ 0, < 3.10.21: Affected (python)
- ≥ 3.11.0, < 3.11.16: Affected (python)
- ≥ 3.12.0, < 3.12.14: Affected (python)
- ≥ 3.13.0, < 3.13.14: Affected (python)
- ≥ 3.14.0, < 3.14.6: Affected (python)
- ≥ 3.15.0a1, < 3.15.0b2: Affected (python)
Update to 3.10.21; Update to 3.11.16; Update to 3.12.14; Update to 3.13.14; Update to 3.14.6; Update to 3.15.0b2
pypy3 Debian:13
- Versions
- 7.3.19+dfsg-2
- 7.3.20+dfsg-1
- 7.3.20+dfsg-2
- 7.3.20+dfsg-3
- 7.3.20+dfsg-4
- 7.3.21+dfsg-1
- 7.3.21+dfsg-2
- 7.3.21+dfsg-3
- 7.3.21+dfsg-4
- 7.3.22+dfsg-1
- 7.3.23+dfsg-1
- 7.3.23+dfsg-2
- 8.0.0+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
pypy3 Debian:14
- Versions
- 7.3.19+dfsg-2
- 7.3.20+dfsg-1
- 7.3.20+dfsg-2
- 7.3.20+dfsg-3
- 7.3.20+dfsg-4
- 7.3.21+dfsg-1
- 7.3.21+dfsg-2
- 7.3.21+dfsg-3
- 7.3.21+dfsg-4
- 7.3.22+dfsg-1
- 7.3.23+dfsg-1
- 7.3.23+dfsg-2
- Affected ranges
- ECOSYSTEM: < 8.0.0+dfsg-1
Update to 8.0.0+dfsg-1
python3.13 Debian:13
- Versions
- 3.13.5-2
- 3.13.5-2+deb13u1
- 3.13.5-2+deb13u2
- Affected ranges
- ECOSYSTEM: < 3.13.5-2+deb13u3
Update to 3.13.5-2+deb13u3
python3.13 Debian:14
- Versions
- 3.13.11-1
- 3.13.12-1
- 3.13.5-2
- 3.13.6-1
- 3.13.7-1
- 3.13.8-1
- 3.13.9-1
- Affected ranges
- ECOSYSTEM: < 3.13.14-1
Update to 3.13.14-1
python3.14 Debian:14
- Versions
- 3.14.0-1
- 3.14.0-2
- 3.14.0-3
- 3.14.0-4
- 3.14.0-5
- 3.14.0~a7-1
- 3.14.0~b1-1
- 3.14.0~b2-1
- 3.14.0~b3-1
- 3.14.0~b4-1
- 3.14.0~rc1-1
- 3.14.0~rc2-1
- 3.14.0~rc3-1
- 3.14.2-1
- 3.14.3-1
- 3.14.3-2
- 3.14.3-3
- 3.14.3-4
- 3.14.3-5
- 3.14.4-1
- 3.14.4-2
- 3.14.5-1
- 3.14.5~rc1-1
- Affected ranges
- ECOSYSTEM: < 3.14.6-1
Update to 3.14.6-1
pypy3 Ubuntu:20.04:LTS
- Versions
- 7.1.1+dfsg-1
- 7.2.0+dfsg-1
- 7.3.0+dfsg-1
- 7.3.0+dfsg-1ubuntu2
- 7.3.0+dfsg-1ubuntu3
- 7.3.1+dfsg-4
- 7.3.1+dfsg-4ubuntu0.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
pypy3 Ubuntu:22.04:LTS
- Versions
- 7.3.5+dfsg-2
- 7.3.7+dfsg-1
- 7.3.7+dfsg-4
- 7.3.7+dfsg-5
- 7.3.8+dfsg-2
- 7.3.9+dfsg-1
- 7.3.9+dfsg-1ubuntu0.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
pypy3 Ubuntu:24.04:LTS
- Versions
- 7.3.12+dfsg-1
- 7.3.13+dfsg-1
- 7.3.14+dfsg-1
- 7.3.15+dfsg-1
- 7.3.15+dfsg-1build2
- 7.3.15+dfsg-1build3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
python3.12 Ubuntu:24.04:LTS
- Versions
- 3.12.0-1
- 3.12.0-5
- 3.12.0-6
- 3.12.0-7
- 3.12.1-2
- 3.12.2-1
- 3.12.2-4build3
- 3.12.2-4build4
- 3.12.2-5ubuntu3
- 3.12.3-1
- 3.12.3-1ubuntu0.1
- 3.12.3-1ubuntu0.2
- 3.12.3-1ubuntu0.3
- 3.12.3-1ubuntu0.4
- 3.12.3-1ubuntu0.5
- 3.12.3-1ubuntu0.6
- 3.12.3-1ubuntu0.7
- 3.12.3-1ubuntu0.8
- 3.12.3-1ubuntu0.9
- 3.12.3-1ubuntu0.10
- 3.12.3-1ubuntu0.11
- 3.12.3-1ubuntu0.12
- 3.12.3-1ubuntu0.13
- Affected ranges
- ECOSYSTEM: < 3.12.3-1ubuntu0.15
Update to 3.12.3-1ubuntu0.15
pypy3 Ubuntu:25.10
- Versions
- 7.3.19+dfsg-1
- 7.3.19+dfsg-2
- 7.3.20+dfsg-1
- 7.3.20+dfsg-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
python3.13 Ubuntu:25.10
- Versions
- 3.13.3-1
- 3.13.3-2
- 3.13.3-4
- 3.13.4-1
- 3.13.5-1
- 3.13.5-2
- 3.13.6-1
- 3.13.7-1
- 3.13.7-1ubuntu0.1
- 3.13.7-1ubuntu0.2
- 3.13.7-1ubuntu0.3
- 3.13.7-1ubuntu0.4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
python3.14 Ubuntu:25.10
- Versions
- 3.14.0~a7-0ubuntu1
- 3.14.0~b1-1
- 3.14.0~b3-1
- 3.14.0~rc1-1
- 3.14.0~rc2-1
- 3.14.0~rc3-1
- 3.14.0-1
- 3.14.0-1ubuntu0.1
- 3.14.0-1ubuntu0.2
- 3.14.0-1ubuntu0.3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
pypy3 Ubuntu:26.10
- Versions
- 7.3.20+dfsg-4
- 7.3.23+dfsg-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
pypy3 Ubuntu:26.04:LTS
- Versions
- 7.3.20+dfsg-3
- 7.3.20+dfsg-4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
python3.14 Ubuntu:26.04:LTS
- Versions
- 3.14.0-1
- 3.14.0-2
- 3.14.0-4
- 3.14.2-1
- 3.14.3-1
- 3.14.3-2
- 3.14.3-3
- 3.14.3-5
- 3.14.4-1
- Affected ranges
- ECOSYSTEM: < 3.14.4-1ubuntu0.1
Update to 3.14.4-1ubuntu0.1
Original sources
- https://github.com/python/cpython/pull/149487
- https://github.com/python/cpython/issues/149486
- https://mail.python.org/archives/list/[email protected]/thread/4FU62L2M6RMMHT2QPGQNPEHHUND7CEX5/
- https://github.com/python/cpython/commit/0478bd83d82b255e0f29f613367a59d261e7eaa2
- https://github.com/python/cpython/commit/0d28f5e46e151718972dfabd91205444d0037b6d
- https://github.com/python/cpython/commit/578411982c16f753f4893532510099ef665117da
- https://github.com/python/cpython/commit/5cf47a248c35c375d610b87b2f72fd1ed454b558
- https://github.com/python/cpython/commit/74cca9a92fb7d653e404843a56b8bdc7b0afdbbf
- https://github.com/python/cpython/commit/10a13bee3c24f9c62b602e696334ff2272a40efc
- https://github.com/python/cpython/commit/c063191cb7f9170f9565e305f8aa2b79ab2bf609
- http://www.openwall.com/lists/oss-security/2026/06/04/9
- https://nvd.nist.gov/vuln/detail/CVE-2026-7774