CVE-2026-11940
Description
tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory. This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330.
How to fix
- Python Software Foundation CPython3.10.21, 3.11.16, 3.12.14, 3.13.15, 3.14.7, 3.15.0b4 or later
- github.com/python/cpython/pull/151559
- github.com/python/cpython/commit/27dd970bf6b17ebca7c8ed486a40ab043ed7af8f
- github.com/python/cpython/commit/672825e2f36a57e173959b0d9d409d4560dab8df
- github.com/python/cpython/commit/771d12dda5140313db0ac550292987975651bbde
- github.com/python/cpython/commit/79c06bd5c6afa3c440d50faf7ee1b147c8832b4c
- github.com/python/cpython/commit/be13e86f6b9788a6f4d0419dffef72cbae5865c9
- github.com/python/cpython/commit/e5fdbd8d5aa923bd9111b112ea73bd6ec7c47877
- github.com/python/cpython/commit/0f852b3f07dd8e71e40326a51c02afbf16a42cc5
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Python Software Foundation CPython | v < 3.10.21, 3.11.0 ≤ v < 3.11.16, 3.12.0 ≤ v < 3.12.14, 3.13.0 ≤ v < 3.13.15, 3.14.0 ≤ v < 3.14.7, 3.15.0a1 ≤ v < 3.15.0b4 | 3.10.21, 3.11.16, 3.12.14, 3.13.15, 3.14.7, 3.15.0b4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.