Low 2.0Published Jun 30, 2026

CVE-2026-4360Tarfile.extract() doesn't fully respect filter parameter

Updated under an hour ago (Oct 27, 2026, 3:30 AM ET)

Does this affect you?

It affects Python Software Foundation CPython and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Python Software Foundation CPython

Exploited in the last 30 days

In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.

CVSS: 2.0 LOW (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness (CWE): CWE-281
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: PSF
NVD analysis: Modified
Record last updated: Aug 12, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Python Software Foundation CPython python_software_foundation:cpython (from the name)	before 3.10.21; from 3.11.0 before 3.11.16; from 3.12.0 before 3.12.14; from 3.13.0 before 3.13.15; from 3.14.0 before 3.14.7; from 3.15.0a1 before 3.15.0b4	CNA record
python python python:python	before 3.1.5	NVD

References

References

https://mail.python.org/archives/list/security-announce@python.org/thread/TWZW2PC2AZOV6FENIHFSRC63OM7MBGSB/	vendor-advisory, issue-tracking
https://github.com/python/cpython/pull/151988	patch, issue-tracking
https://github.com/python/cpython/issues/151987	issue-tracking, patch
https://github.com/python/cpython/commit/5e0ef3f1afe892e4f64eb83368db57ac4c40cba0	patch
https://github.com/python/cpython/commit/7b57e8d51446297b8c7c482d224bc5f1938e4301	patch
https://github.com/python/cpython/commit/7ccdbaba2c54250a70d7f25632152df7655a5e0a	patch
https://github.com/python/cpython/commit/eee3ddf0ca10283cc7fea724aae9cd8665f8d15e	patch
https://github.com/python/cpython/commit/d2b2f5eacab4dd48446b63340613b05dcbbf0b44	patch
https://github.com/python/cpython/commit/cf23b9153181062150d061468b6d24af33fe214f	patch
https://github.com/python/cpython/commit/0367912be336348b30572f8029cec4a282782d92	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.