{"id":"CVE-2026-114583","kind":"vulnerability","aliases":["CVE-2026-114583"],"related":[],"title":"Python tarfile: crafted links bypass tar filter, write files outside extraction directory","description":"tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter=\"tar\" to write files outside the destination directory, subject to the permissions of the extracting process.\n\nThis is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter.","summary":"A crafted tar archive with malicious link entries, including symlinks with empty or directory-like names, can make later members land outside the extraction directory when code calls tarfile.extractall() with filter=\"tar\". The attacker gets file writes outside the destination, limited by the permissions of the extracting process.","severity":"medium","cvss":6.9,"epss":0.00207,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["archive-extraction","file-upload","python","runtime","tarfile"],"not_affected_if":["no-extractall","no-tar-filter","trusted-archives-only"],"how_to_check":"- Run `python3 --version` and compare against the patched release named in the Python advisory (the sources do not give the fixed version).\n- Search the codebase for `extractall(` and `filter=\"tar\"` to find code that extracts archives with this filter.","fix":"- Upgrade to a patched Python release; the sources do not name the fixed version.\n- Until patched, extract only archives from trusted sources, or validate archive members before extraction.","status":"open","published_at":"2026-10-22T21:17:16+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T03:38:48+00:00","updated_at":"2026-10-25T03:38:48+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T03:38:48Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to a patched Python release; the sources do not name the fixed version.\n- Until patched, extract only archives from trusted sources, or validate archive members before extraction.","reach":"unknown","title":"Python tarfile: crafted links bypass tar filter, write files outside extraction directory","impact":"medium","summary":"A crafted tar archive with malicious link entries, including symlinks with empty or directory-like names, can make later members land outside the extraction directory when code calls tarfile.extractall() with filter=\"tar\". The attacker gets file writes outside the destination, limited by the permissions of the extracting process.","category":"runtime","nicknames":[],"who_cares":["python","tarfile","archive-extraction","file-upload"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Files written outside the extraction directory, within process permissions","analyst_note":"","how_to_check":"- Run `python3 --version` and compare against the patched release named in the Python advisory (the sources do not give the fixed version).\n- Search the codebase for `extractall(` and `filter=\"tar\"` to find code that extracts archives with this filter.","needs_analyst":false,"not_affected_if":["trusted-archives-only","no-tar-filter","no-extractall"],"who_is_affected":"Applications running Python that call tarfile.extractall() with filter=\"tar\" on archives an outside party can supply, such as user uploads or downloaded packages. Code that extracts only trusted archives, or that does not use the tar filter, is less exposed. The sources do not say which Python versions are affected.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.001243,"input_tokens":3414,"output_tokens":1804,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114583':15A,18A '-2026':14A,17A,140C '-7774':141C 'allow':106C 'archiv':20B,31B,98C,110C 'archive-extract':19B 'attack':62B 'bypass':5A,81C 'call':56B 'caus':112C 'code':55B 'could':79C 'counterpart':137C 'cover':143C 'craft':3A,29B,83C 'cve':13A,16A,139C 'destin':68B,122C 'directori':12A,42B,53B,92C,104C,123C 'directory-lik':41B,91C 'empti':39B,89C 'entri':35B,85C 'extract':11A,21B,52B,75B,103C,130C 'file':9A,23B,64B,119C 'file-upload':22B 'filter':7A,59B,78C,115C,136C,145C 'get':63B 'includ':36B,86C 'intend':102C 'land':49B 'later':47B,97C 'like':43B,93C 'limit':69B 'link':4A,34B,84C 'make':46B 'malici':33B,108C 'member':48B,99C 'name':44B,94C 'outsid':10A,50B,66B,100C,120C 'permiss':72B,127C 'process':76B,131C 'python':1A,25B 'redirect':96C 'runtim':26B 'subject':124C 'symlink':37B,87C 'tar':6A,30B,60B,109C,116C 'tarfil':2A,27B 'tarfile.data':144C 'tarfile.extractall':57B,113C 'tarfile.tar':77C,135C 'upload':24B 'use':82C 'write':8A,65B,118C","nicknames":[],"mitigations":[],"who_affected":"Applications running Python that call tarfile.extractall() with filter=\"tar\" on archives an outside party can supply, such as user uploads or downloaded packages. Code that extracts only trusted archives, or that does not use the tar filter, is less exposed. The sources do not say which Python versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T21:17:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@python.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114583","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114583","severity":null,"published_at":"2026-10-22T21:17:16+00:00","modified_at":"2026-10-23T16:44:17+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114583","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114583","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}