CVE Feed

    Dashboard / CVE / CVE-2026-82049

    CVE-2026-82049

    In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.

    Published:Sep 14, 2026
    Last Modified:Oct 11, 2026
    EPS:Sep 14, 2026
    EPSS Score:0.00188
    CVSS Score:7.1

    Affected Products

    Vendor
    Python
    Product
    Cpython

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-115557 (CVSS 9.4) — Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even …
    CVE-2026-114583 (CVSS 6.9) — tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-li…
    CVE-2026-19553 (CVSS 7.6) — ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_h…
    CVE-2026-19445 (CVSS 9.2) — A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callba…
    CVE-2026-12345 (CVSS 5.9) — The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the t…
    CVE-2026-87910 (CVSS 5.7) — When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from…
    CVE-2026-15310 (CVSS 2.1) — When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacke…
    CVE-2026-19672 (CVSS 6.3) — The tarfile module's tar and data extraction filters created directories outside the destination for members…
    CVE-2026-15806 (CVSS 6) — The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRe…
    CVE-2026-17084 (CVSS 6) — The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unico…

    References

    https://github.com/python/cpython/commit/197663d63afed27f66e10e23c194e8a634e60913
    https://github.com/python/cpython/commit/28f315486b3da0352b9a1de1c3c97f4127ba4771
    https://github.com/python/cpython/commit/5a57248b22ad3b9aafcaaadae2c304a1923daeca
    https://github.com/python/cpython/commit/b38be2e6cf9d989075ab73412c63e003ebad4ff3
    https://github.com/python/cpython/commit/b8f23e307097552eaea2604383a12ab280520d0d
    https://github.com/python/cpython/commit/c66df4e70435d257fd488b35ea129c6f317433a8
    https://github.com/python/cpython/commit/cc1689830c6b9aaddded2fb9f2fe8116867e2c0e
    https://github.com/python/cpython/commit/cccc7ec30212dba2abef53ce4a2bed112ddb690c
    https://github.com/python/cpython/issues/157190
    https://github.com/python/cpython/pull/157191
    https://mail.python.org/archives/list/[email protected]/thread/EFJWGAZJA56AKSBR2WHMHQZO7RRLZPRH/
    http://www.openwall.com/lists/oss-security/2026/09/14/27

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High