Medium 5.7Published Sep 11, 2026

CVE-2026-87910tarfile hardlink fallback ignores custom extraction filter rejection via None

Updated under an hour ago (Oct 28, 2026, 3:00 AM ET)

Does this affect you?

It affects Python Software Foundation CPython. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Python Software Foundation CPython

Exploited in the last 30 days

When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.

CVSS: 5.7 MEDIUM (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness (CWE): CWE-22, CWE-59
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: PSF
NVD analysis: Awaiting Analysis
Record last updated: Oct 21, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Python Software Foundation CPython python_software_foundation:cpython (from the name)	before 3.10.22; from 3.11.0 before 3.11.17; from 3.12.0 before 3.12.15; from 3.13.0 before 3.13.16; from 3.14.0 before 3.14.9; from 3.15.0a1 before 3.15.0rc3	CNA record

References

References

https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/	vendor-advisory
https://github.com/python/cpython/pull/157266	patch
https://github.com/python/cpython/issues/157265	issue-tracking
https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b	patch
https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2	patch
https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955	patch
https://github.com/python/cpython/commit/764fd0af8d9e19d3684a58d2e58bf770f0605036	patch
https://github.com/python/cpython/commit/2eb0c2f1dc71847731b6ab30aebefd058d482a7f	patch
https://github.com/python/cpython/commit/c1f106d240c4ffcb3608ed0a20e8aba6c865f6d3	patch
https://github.com/python/cpython/commit/3105a3498aaf681ce128cf5baf83c2e5574267c5	patch
1–10 of 12

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.