55
47
30
60
42
60
42
55
42
42
55
47
60
60
60
47
60
55
60
35
35
47
42
42
60
60
Cpython: [CVE-2026-82049] tarfile extraction filters allow file modification and content disclosure via hard link to symlink
Python discloses CVE-2026-82049: tarfile extraction filters can be bypassed via hard links to symlinks, enabling file modification and content disclosure.
Stan Ulbrych disclosed CVE-2026-82049 on the Python security-announce list, forwarded to oss-security by Alan Coopersmith. The flaw affects CPython's tarfile extraction filters, which can allow file modification and content disclosure when archives contain a hard link to a symlink. Extraction-filter misuse can therefore bypass intended protections during archive unpacking.
35
35
55
35
30
55
60
42
60
60
30
30
30
55