High 8.4Published Sep 14, 2026

CVE-2026-82049tarfile extraction filters allow file modification and content disclosure via hard link to symlink

Updated under an hour ago (Oct 26, 2026, 11:10 PM ET)

Does this affect you?

It affects Python Software Foundation CPython. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Python Software Foundation CPython

Exploited in the last 30 days

In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.

CVSS: 8.4 HIGH (v4.0, CNA)CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness (CWE): CWE-59
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: PSF
NVD analysis: Awaiting Analysis
Record last updated: Oct 10, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Python Software Foundation CPython python_software_foundation:cpython (from the name)	before 3.10.22; from 3.11.0 before 3.11.17; from 3.12.0 before 3.12.15; from 3.13.0 before 3.13.16; from 3.14.0a1 before 3.14.0b1	CNA record

References

References

https://github.com/python/cpython/commit/5a57248b22ad3b9aafcaaadae2c304a1923daeca	patch
https://github.com/python/cpython/issues/157190	issue-tracking
https://github.com/python/cpython/pull/157191	patch
https://mail.python.org/archives/list/security-announce@python.org/thread/EFJWGAZJA56AKSBR2WHMHQZO7RRLZPRH/	vendor-advisory
https://github.com/python/cpython/commit/b38be2e6cf9d989075ab73412c63e003ebad4ff3	patch
https://github.com/python/cpython/commit/b8f23e307097552eaea2604383a12ab280520d0d	patch
https://github.com/python/cpython/commit/197663d63afed27f66e10e23c194e8a634e60913	patch
https://github.com/python/cpython/commit/28f315486b3da0352b9a1de1c3c97f4127ba4771	patch
https://github.com/python/cpython/commit/c66df4e70435d257fd488b35ea129c6f317433a8	patch
https://github.com/python/cpython/commit/cc1689830c6b9aaddded2fb9f2fe8116867e2c0e	patch
1–10 of 11

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.