CPython: [CVE-2026-87910] tarfile hardlink fallback ignores custom extraction filter rejection via None

CVE-2026-87910 is a filter-bypass flaw in CPython's tarfile module: when tarfile extracts a hard or symbolic link on a filesystem that does not support links, it falls back to extracting the member the link points to, and the extraction filter is run twice, once for the extracted member and once with the name set to the link's location. In one of these two calls, a None return value, which is how a custom filter rejects or skips a member, was ignored, so a member the filter rejected could still be written to disk. An attacker who can supply a crafted tar archive could thereby extract members to locations the filter was intended to prevent, producing unintended or potentially traversing file placement (CWE-22, CWE-59; the CVSS 4.0 score of 5.7 reflects high integrity impact with no confidentiality or availability impact). Affected users are those running CPython and extracting archives with a custom extraction filter that rejects members via None on a filesystem without link support; the advisory data does not specify the affected version ranges. No public proof-of-concept, CISA KEV listing, or known exploitation has been reported.

Do: Upgrade CPython to a release containing the fix for CVE-2026-87910 as soon as your vendor or distribution ships it, monitoring python.org security advisories for the patched versions. As an interim mitigation, do not rely on a custom extraction filter's None return to skip members when extracting archives containing hard or symbolic links on filesystems without link support, and audit code paths that call extract/extractall with user-controlled archives. After patching, review extraction destinations for members that should have been skipped.