CVE-2026-11940: tarfile extraction filter bypass allows escaping the destination directory
tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory. This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/pypy3to a version that resolves this vulnerability.Fixed in 8.0.0+dfsg-1 - Upgrade
Upgrade
debian/python3.13to a version that resolves this vulnerability.Fixed in 3.13.5-2+deb13u5 - Upgrade
Upgrade
debian/python3.14to a version that resolves this vulnerability.Fixed in 3.14.7-1 - Upgrade
Upgrade
debian/pypy3to a version that resolves this vulnerability.Fixed in 7.3.11+dfsg-2+deb12u3Fixed in 8.0.1+dfsg-1 - Upgrade
Upgrade
debian/python3.13to a version that resolves this vulnerability.Fixed in 3.13.5-2+deb13u5Fixed in 3.13.18-1 - Upgrade
Upgrade
debian/python3.14to a version that resolves this vulnerability.Fixed in 3.14.10-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11940?
CVE-2026-11940 has a high severity rating of 7.8 according to the CVSS score.
How do I fix CVE-2026-11940?
To fix CVE-2026-11940, you should upgrade to the latest version of Python CPython that includes security patches addressing this vulnerability.
What type of attack does CVE-2026-11940 pertain to?
CVE-2026-11940 pertains to path traversal attacks that can be exploited during the extraction of crafted tarfile archives.
What software is affected by CVE-2026-11940?
CVE-2026-11940 affects Python CPython, particularly in its tarfile module.
What is the risk associated with CVE-2026-11940?
The risk associated with CVE-2026-11940 includes potential unauthorized file access or manipulation due to the symlink traversal vulnerability.