CVE-2026-7774: tarfile.data_filter path traversal bypass allows writing outside the extraction directory
Last updated 6 July 2026
Other sources
tarfile.datafilter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process.
— MITRE
tarfile.datafilter path traversal bypass allows writing outside the extraction directory
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.12.9-13 - Upgrade
Upgrade
debian/python3.13to a version that resolves this vulnerability.Fixed in 3.13.14-1 - Upgrade
Upgrade
debian/python3.14to a version that resolves this vulnerability.Fixed in 3.14.6-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7774?
CVE-2026-7774 has a medium severity rating of 6.9.
What does CVE-2026-7774 exploit?
CVE-2026-7774 exploits a path traversal vulnerability that allows writing files outside the intended extraction directory.
How do I fix CVE-2026-7774?
To fix CVE-2026-7774, update to the latest version of Python CPython that addresses this vulnerability.
What is the impact of CVE-2026-7774?
The impact of CVE-2026-7774 allows malicious tar archives to redirect file extraction, potentially overwriting sensitive files.
Which software is affected by CVE-2026-7774?
CVE-2026-7774 affects the Python CPython tarfile module.