Medium 6.9Published Oct 22, 2026

CVE-2026-114583tar filter allows writing outside destination via empty-named symlink

Updated under an hour ago (Oct 28, 2026, 3:00 PM ET)

Does this affect you?

It affects Python Software Foundation CPython. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Python Software Foundation CPython

Exploited in the last 30 days

tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter="tar" to write files outside the destination directory, subject to the permissions of the extracting process. This is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter.

CVSS: 6.9 MEDIUM (v4.0, CNA)CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: PSF
NVD analysis: Awaiting Analysis
Record last updated: Oct 26, 2026
First seen by InfoSec Signals: Oct 22, 2026

Affected products

Affected products

Python Software Foundation CPython python_software_foundation:cpython (from the name)	before 3.11.18; from 3.12.0 before 3.12.16; from 3.13.0 before 3.13.18; from 3.14.0 before 3.14.10; from 3.15.0 before 3.15.2; from 3.16.0a1 before 3.16.0	CNA record

References

References

https://github.com/python/cpython/pull/160098	patch
https://github.com/python/cpython/issues/160097	issue-tracking
https://mail.python.org/archives/list/security-announce@python.org/thread/43JOWPRAV5DI3VZ4FUEUAZOHCATXXOCK/
https://github.com/python/cpython/commit/0901ad4ffb22605f12b705d1c1197f0a01f0ba0b	patch
https://github.com/python/cpython/commit/c6ada40177436e4e2533a7b252082b5f0c043477	patch
https://github.com/python/cpython/commit/e7e0b3523ad6ba8472873dda594cf4021a16f8b5	patch
https://github.com/python/cpython/commit/04d8fca7da2cf3ebc0881fec8a53a1330c3b665d	patch
https://github.com/python/cpython/commit/bc93f8ad4c4a0f92d184ec8fccc8ff8a651dcec2	patch
https://github.com/python/cpython/commit/f4401da82e2baec5dab06cf070fbca77d53220f0	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.