PT-2026-34538 · Pypi+1 · Poetry+1

CVE-2026-41140 · Published 2026-04-22 · Updated 2026-07-13

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Poetry versions prior to 2.3.4

Description The extractall() function in src/poetry/utils/helpers.py extracts sdist tarballs without path traversal protection on Python versions where tarfile.data filter is unavailable. This occurs specifically on Python versions 3.10.0 through 3.10.12 and 3.11.0 through 3.11.4. An attacker can use a crafted sdist with ../../ tar member paths to perform arbitrary file writes outside the intended extraction directory. This can be achieved through direct path traversal, symlink traversal, or hardlink attacks. The issue is triggered during metadata resolution or when building a package from sdist.

Recommendations Update Poetry to version 2.3.4 or newer.

Exploit

Fix

DoS

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2026-07726

CVE-2026-41140

GHSA-73H3-MF4W-8647

PYSEC-2026-2890

Affected Products

Poetry

Red Os

References · 27

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41140.json · Exploit
• https://bdu.fstec.ru/vul/2026-07726 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-2890 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41140 · Security Note
• https://osv.dev/vulnerability/CVE-2026-41140 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-41140 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:24866 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-73h3-mf4w-8647 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-41140 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-41140 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-41140 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-41140 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2026-41140 · Vendor Advisory
• https://github.com/python-poetry/poetry · Note
• https://github.com/python-poetry/poetry/releases/tag/2.3.4 · Note