PT-2026-53894 · Python · Python

Michael Scovetta + 2 · Published 2026-06-30 · Updated 2026-06-30 · CVE-2026-4360

Positive Technologies (AI Summary)

CVSS v4.0

2.0

Low

Base vector

AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Python (affected versions not specified)

Description In the extract() function of the Tarfile module, the filter parameter is not correctly handled when extracting hardlinks. This issue allows a system extracting content from untrusted tar files to write files with an unexpected uid/gid, even when the user has specified filter='data' to restrict the extraction process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

Related Identifiers

CVE-2026-4360

Affected Products

Python

References · 9

• https://github.com/python/cpython/commit/eee3ddf0ca10283cc7fea724aae9cd8665f8d15e · Patch
• https://github.com/python/cpython/commit/7ccdbaba2c54250a70d7f25632152df7655a5e0a · Patch
• https://github.com/python/cpython/commit/7b57e8d51446297b8c7c482d224bc5f1938e4301 · Patch
• https://github.com/python/cpython/pull/151988 · Patch
• https://github.com/python/cpython/commit/5e0ef3f1afe892e4f64eb83368db57ac4c40cba0 · Patch
• https://mail.python.org/archives/list/[e-mail]/thread/TWZW2PC2AZOV6FENIHFSRC63OM7MBGSB · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4360 · Security Note
• https://github.com/python/cpython/issues/151987 · Note
• https://twitter.com/VulmonFeeds/status/2071981568097243433 · Twitter Post