CVE-2026-7774
Medium
Description
tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process.
SeverityMedium
CVSS6.9
Exploit probability—
ProductCPython
PublishedJun 4, 2026
First seenJun 4, 2026
Weakness typeCWE-22Path traversal
How to fix
Update
- Python Software Foundation CPython3.10.21, 3.11.16, 3.12.14, 3.13.14, 3.14.6, 3.15.0b2 or later
Patches
- github.com/python/cpython/pull/149487
- github.com/python/cpython/commit/0478bd83d82b255e0f29f613367a59d261e7eaa2
- github.com/python/cpython/commit/0d28f5e46e151718972dfabd91205444d0037b6d
- github.com/python/cpython/commit/578411982c16f753f4893532510099ef665117da
- github.com/python/cpython/commit/5cf47a248c35c375d610b87b2f72fd1ed454b558
- github.com/python/cpython/commit/74cca9a92fb7d653e404843a56b8bdc7b0afdbbf
- github.com/python/cpython/commit/10a13bee3c24f9c62b602e696334ff2272a40efc
- github.com/python/cpython/commit/c063191cb7f9170f9565e305f8aa2b79ab2bf609
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Python Software Foundation CPython | v < 3.10.21, 3.11.0 ≤ v < 3.11.16, 3.12.0 ≤ v < 3.12.14, 3.13.0 ≤ v < 3.13.14, 3.14.0 ≤ v < 3.14.6, 3.15.0a1 ≤ v < 3.15.0b2 | 3.10.21, 3.11.16, 3.12.14, 3.13.14, 3.14.6, 3.15.0b2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.