Medium severity · published Jun 30, 2026
CVE-2026-4360
Tarfile.extract() doesn't fully respect filter parameter
5.3
CVSS
0.5%
EPSS
No
On KEV
Description
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CP
CPython · Python Software Foundation
before 3.10.21; 3.11.0 before 3.11.16; 3.12.0 before 3.12.14; 3.13.0 before 3.13.15; 3.14.0 before 3.14.7; 3.15.0a1 before 3.15.0b4 · source: vendor
PY
Python · Python
before 3.1.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-4360
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-4360
github.com
https://github.com/python/cpython/commit/0367912be336348b30572f8029cec4a282782d92
Patch
https://github.com/python/cpython/commit/5e0ef3f1afe892e4f64eb83368db57ac4c40cba0
Patch
https://github.com/python/cpython/commit/7b57e8d51446297b8c7c482d224bc5f1938e4301
Patch
https://github.com/python/cpython/commit/7ccdbaba2c54250a70d7f25632152df7655a5e0a
github.com
https://github.com/python/cpython/commit/cf23b9153181062150d061468b6d24af33fe214f
Patch
https://github.com/python/cpython/commit/d2b2f5eacab4dd48446b63340613b05dcbbf0b44
More from CPython
9.4
CVE-2026-115557
Distrust compromised intermediate certificates in ssl module
9.2
CVE-2026-19445
Use-after-free of a server-side SSLContext when sni_callback switches contexts
8.8
CVE-2026-3298
Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes
8.4
CVE-2026-82049
tarfile extraction filters allow file modification and content disclosure via hard link to symlink
8.2
CVE-2026-11972
tarfile opened in streaming mode mishandles EOF