CVE-2026-4360: Tarfile.extract() doesn't fully respect filter parameter
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
Other sources
Tarfile.extract() doesn't fully respect filter parameter
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.12.9-14
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4360?
CVE-2026-4360 has a risk score of 47, indicating a moderate potential impact.
How do I fix CVE-2026-4360?
To fix CVE-2026-4360, update your Python installation to the latest version that addresses the issue in the Tarfile.extract() function.
What systems are affected by CVE-2026-4360?
CVE-2026-4360 affects systems using the Python tarfile module when extracting files from untrusted tar archives.
What are the potential risks of CVE-2026-4360?
The potential risks of CVE-2026-4360 include unauthorized file creation with unexpected user IDs and group IDs.
How does CVE-2026-4360 affect the Tarfile.extract() function?
CVE-2026-4360 affects the Tarfile.extract() function by improperly handling the filter parameter for hardlinks, leading to possible security vulnerabilities.