CVE-2026-82049
High
Description
In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.
SeverityHigh
CVSS8.4
Exploit probability—
ProductCPython
PublishedSep 14, 2026
First seenSep 14, 2026
Weakness typeCWE-59Improper link resolution
How to fix
Update
- Python Software Foundation CPython3.10.22, 3.11.17, 3.12.15, 3.13.16, 3.14.0b1 or later
Patches
- github.com/python/cpython/commit/5a57248b22ad3b9aafcaaadae2c304a1923daeca
- github.com/python/cpython/pull/157191
- github.com/python/cpython/commit/b38be2e6cf9d989075ab73412c63e003ebad4ff3
- github.com/python/cpython/commit/b8f23e307097552eaea2604383a12ab280520d0d
- github.com/python/cpython/commit/197663d63afed27f66e10e23c194e8a634e60913
- github.com/python/cpython/commit/28f315486b3da0352b9a1de1c3c97f4127ba4771
- github.com/python/cpython/commit/c66df4e70435d257fd488b35ea129c6f317433a8
- github.com/python/cpython/commit/cc1689830c6b9aaddded2fb9f2fe8116867e2c0e
- github.com/python/cpython/commit/cccc7ec30212dba2abef53ce4a2bed112ddb690c
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Python Software Foundation CPython | v < 3.10.22, 3.11.0 ≤ v < 3.11.17, 3.12.0 ≤ v < 3.12.15, 3.13.0 ≤ v < 3.13.16, 3.14.0a1 ≤ v < 3.14.0b1 | 3.10.22, 3.11.17, 3.12.15, 3.13.16, 3.14.0b1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.