Executive brief
A vulnerability exists in the Python 'tarfile' module, which is commonly used by developers to read and extract compressed archive files. A malicious actor could create a specially crafted archive that, when opened, bypasses security filters to write files to unauthorized locations on the computer. This could allow an attacker to overwrite sensitive system files or application data, potentially leading to a full system compromise depending on the permissions of the user running the script.
Technical details
A path traversal vulnerability (CWE-22) exists in the Python 'tarfile' module's 'data_filter' mechanism. The filter fails to properly validate link entries, specifically symlinks with empty names or directory-like structures, which can be used to redirect subsequent archive members to locations outside the target extraction directory. The root cause is a discrepancy where the filter performed containment checks against un-normalized paths while the extraction process used normalized paths. An attacker can exploit this by providing a malicious TAR archive to an application using 'tarfile.extractall()' with the 'data_filter' enabled. Patches have been developed for CPython versions 3.12 through 3.15.
Affected products
- Python Software Foundation CPython 3.12, 3.13, 3.14, 3.15
Timeline
- 2026-05-07: disclosed: Issue reported on GitHub
- 2026-05-08: patched: Fix merged into CPython main branch
- 2026-06-04: advisory: Official security announcement and CVE published