Executive brief
A vulnerability in the Python standard library's tarfile module could allow untrusted files to be extracted with incorrect ownership permissions. When a program processes a specially crafted archive, it may ignore security filters intended to restrict file attributes like user and group IDs. This could lead to files being created with unexpected permissions, potentially allowing unauthorized access to sensitive data on the system.
Technical details
A vulnerability exists in the `Tarfile.extract()` function of Python's `tarfile` module where the `filter` parameter is not correctly passed when extracting hardlinks whose targets are missing. In such cases, the file is extracted from the archive rather than linked, but the security filter (such as `filter='data'`) is bypassed. An attacker providing a malicious tar archive can cause files to be written with unexpected UID/GID values, violating the security guarantees of the extraction filter. This is classified as a failure to properly preserve permissions (CWE-281). The issue is addressed in CPython versions 3.10 through 3.15 via backported security fixes and is fully resolved in version 3.16.0.
Affected products
- Python Software Foundation CPython < 3.16.0
Timeline
- 2026-06-23: disclosed: Issue reported on CPython GitHub repository
- 2026-06-29: patched: Fix merged into CPython main branch
- 2026-06-30: advisory: Security announcement and CVE publication