CVE-2026-87910: tarfile hardlink fallback ignores custom extraction filter rejection via None
When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.
Affected Software
Event History
Frequently Asked Questions
Which environments are exposed to this behavior?
The issue occurs when tarfile extracts a link on a system that does not support links and therefore falls back to extracting a member from the archive. It is relevant where a custom extraction filter is used to reject members by returning None.
What must an attacker provide to exploit it?
An attacker would need an archive containing a link that triggers the no-link-support fallback and a target member involved in that fallback. The custom extraction filter must return None for one of the two filter calls whose result was ignored.
Are archives blocked by a custom extraction filter always skipped?
No. In the affected fallback path, tarfile runs the filter twice, but ignores one return value. A member can therefore be extracted even when either the member check or the link-location check returns None.
What is the intended safe behavior?
The member should be skipped if either of the two extraction-filter calls returns None. Systems relying on custom filters should ensure this condition is enforced for hardlink fallback extraction paths.