CPython gzip, tarfile, and zipfile CLIs can shadow stdlib (CVE-2026-115791)
Python's security list rates the flaw medium; the excerpt gives no fixed version or exploitation status.
Stories per day · 30 days
4 stories, newest first · one card per story
Stories tagged #tarfile
CPython tarfile filter bypass writes outside the extraction directory
CVE-2026-114583 was forwarded to oss-security; the body is truncated before versions or a fix.
Cpython: [CVE-2026-82049] tarfile extraction filters allow file modification and content disclosure via hard link to symlink
Python discloses CVE-2026-82049: tarfile extraction filters can be bypassed via hard links to symlinks, enabling file modification and content disclosure.
CPython: [CVE-2026-87910] tarfile hardlink fallback ignores custom extraction filter rejection via None
CPython CVE-2026-87910: tarfile's hardlink fallback ignores custom extraction filters that reject entries via None, rated MEDIUM severity.