Cpython: [CVE-2026-82049] tarfile extraction filters allow file modification and content disclosure via hard link to symlink
Python discloses CVE-2026-82049: tarfile extraction filters can be bypassed via hard links to symlinks, enabling file modification and content disclosure.
Stan Ulbrych disclosed CVE-2026-82049 on the Python security-announce list, forwarded to oss-security by Alan Coopersmith. The flaw affects CPython's tarfile extraction filters, which can allow file modification and content disclosure when archives contain a hard link to a symlink. Extraction-filter misuse can therefore bypass intended protections during archive unpacking.
- CVE-2026-82049 affects CPython tarfile extraction filters
- Hard links to symlinks allow file modification and content disclosure during extraction
- Disclosed via Python security-announce and forwarded to oss-security
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-82049 | Python tarfile extraction filter bypass via hard link to symlink (CPython ≤3.13) | 8.4 | — |
From the original article
Posted by Alan Coopersmith on Sep 14 -------- Forwarded Message -------- Subject: [Security-announce][CVE-2026-82049] tarfile extraction filters allow file modification and content disclosure via hard link to symlink Date: Mon, 14 Sep 2026 17:59:38 +0100 From: Stan Ulbrych via Security-announce Reply-To: security-sig () python org To: security-announce () python org CC: Stan Ulbrych ...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.