https://seclists.org/oss-sec/2026/q3/578: [CVE-2026-19672] CPython: tarfile extraction filter bypass allows cation of dictories outside the destination
Published Aug 25, 2026
·Updated
Affected Software
1 affected component
Python CPython
The issue affects CPython tarfile extraction on POSIX platforms. Windows is not affected because .. path components are collapsed before reaching the filesystem.
A member name must leave the extraction destination and then return to it, such as ../evil/../dest/sub/file. To return to the destination, the name must include the destination directory's final component.
No. Only empty directories are created outside the destination; member contents are still extracted within the destination.
Extracting archives into a securely randomized destination directory is not affected, because an archive member cannot predict the destination directory's final component needed to return to it.
The observable impact is the creation of empty directories outside the intended extraction destination. Archive member names that traverse out of the destination and include its final directory component are relevant indicators.