CPython tarfile filter bypass writes outside the extraction directory
Original title: CPython: [CVE-2026-114583] tarfile.tar_filter path traversal bypass allows writing outside the extraction directory
CVE-2026-114583 was forwarded to oss-security; the body is truncated before versions or a fix.
A Python security-announce message forwarded to oss-security reports CVE-2026-114583 in CPython's tarfile.tar_filter. The subject says a path traversal bypass can write outside the extraction directory. Stan Ulbrych sent the notice on October 22, 2026. The available text ends at "There is a," so affected versions, the fix and exploitation status are not in this snippet.
Unconfirmed: Affected versions, fixed releases and whether it is exploited are not in the truncated post.
- The notice was sent to security-announce and copied to oss-security.
- The flaw is described as a tarfile.tar_filter path traversal bypass.
- No patch version or exploitation statement appears in the snippet.
Impact: Write files outside the extraction directory
| Product | Affected |
|---|---|
| Python CPython tarfile | — |
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-114583 | tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members… | 6.9 | — |
From the original article
Posted by Alan Coopersmith on Oct 22 -------- Forwarded Message -------- Subject: [Security-announce][CVE-2026-114583] tarfile. tar_filter path traversal bypass allows writing outside the extraction directory Date: Thu, 22 Oct 2026 21:35:28 +0100 From: Stan Ulbrych via Security-announce Reply-To: security-sig () python org To: security-announce () python org CC: Stan Ulbrych There is a...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.