CVE-2026-12565: Path Traversal (Zip-Slip) in unarchive module
The unarchive internal module's archive extraction commands perform no code-level validation on extracted file paths, relying entirely on the behavior of external tools (e.g. GNU tar) which varies by platform. While CVE-2025-10284 addressed git-specific RCE vectors, the underlying archive extraction path traversal was never fixed. On systems with GNU tar < 1.34 (Ubuntu 20.04, Debian Buster, CentOS 7, many Docker base images), a malicious archive can write files outside the intended extraction directory.
Other sources
The unarchive internal module's archive extraction commands perform no code-level validation on extracted file paths, relying entirely on the behavior of external tools (e.g. GNU tar) which varies by platform. While CVE-2025-10284 addressed git-specific RCE vectors, the underlying archive extraction path traversal was never fixed. On systems with GNU tar < 1.34 (Ubuntu 20.04, Debian Buster, CentOS 7, many Docker base images), a malicious archive can write files outside the intended extraction directory.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/bbotto a version that resolves this vulnerability.Fixed in 2.8.5 - Upgrade
Upgrade
GNU tarto a version that resolves this vulnerability.Fixed in 1.34
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12565?
CVE-2026-12565 has a medium severity rating of 5.3.
How does CVE-2026-12565 affect GNU tar?
CVE-2026-12565 affects GNU tar's unarchive module by allowing path traversal vulnerabilities during archive extraction.
What are the potential exploits of CVE-2026-12565?
Exploiting CVE-2026-12565 can allow an attacker to manipulate file paths in extracted archives, leading to unauthorized file access.
How do I fix CVE-2026-12565?
To mitigate CVE-2026-12565, ensure to implement proper validation checks for extracted file paths in your archive extraction processes.
When was CVE-2026-12565 published?
CVE-2026-12565 was published on June 17, 2026.