Cpython: [CVE-2026-82049] tarfile extraction filters allow file modification and content disclosure via hard link to symlink
Python discloses CVE-2026-82049: tarfile extraction filters can be bypassed via hard links to symlinks, enabling file modification and content disclosure.
Stan Ulbrych disclosed CVE-2026-82049 on the Python security-announce list, forwarded to oss-security by Alan Coopersmith. The flaw affects CPython's tarfile extraction filters, which can allow file modification and content disclosure when archives contain a hard link to a symlink. Extraction-filter misuse can therefore bypass intended protections during archive unpacking.
35