CPython: [CVE-2026-87910] tarfile hardlink fallback ignores custom extraction filter rejection via None
CPython CVE-2026-87910: tarfile's hardlink fallback ignores custom extraction filters that reject entries via None, rated MEDIUM severity.
Petr Viktorin disclosed CVE-2026-87910 on the CPython security-announce list, rated MEDIUM severity. The flaw is in the tarfile module: when a custom extraction filter rejects an entry by returning None, the hardlink fallback path ignores the rejection. The posted excerpt did not include affected versions or patch details.
- tarfile hardlink fallback bypasses extraction filter rejection signaled via None
- Rated MEDIUM severity by the CPython security team
- Disclosed on the CPython security-announce mailing list
- CVEs
- CVE-2026-87910
- Vendors
- CPython
- Products
- CPython
- Organizations
- Python Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-87910 | CPython tarfile link-fallback ignores extraction filter rejection (filter bypass) | 5.7 | — |
From the original article
Posted by Alan Coopersmith on Sep 11 -------- Forwarded Message -------- Subject: [Security-announce][CVE-2026-87910] tarfile hardlink fallback ignores custom extraction filter rejection via None Date: Fri, 11 Sep 2026 14:24:10 +0200 From: Petr Viktorin via Security-announce Reply-To: security-sig () python org To: security-announce () python org CC: Petr Viktorin There is a MEDIUM...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.