https://seclists.org/oss-sec/2026/q3/720: CPython: [CVE-2026-87910] tarfile hardlink fallback ignos custom extraction filter jection via None

Q: When is this issue reachable?

It is reachable when tarfile extracts a link on a system that does not support links and therefore falls back to extracting the linked member from the archive.

Q: What must an attacker provide to exploit the issue?

An attacker would need an archive containing a link that triggers the no-link-support fallback during extraction. The issue concerns custom extraction filters that return None to skip a member.

Q: Why might a custom extraction filter fail to block extraction?

During the fallback, the filter is called twice: for the extracted member and for the link location. One return value was ignored, so a member could be extracted even when one of those filter calls returned None.

Q: What behavior should be expected after the fix?

The member should be skipped if either of the two filter calls returns None.

Published Sep 11, 2026

Updated

Affected Software

1 affected component

Python CPython>=<

Frequently Asked Questions

When is this issue reachable?

It is reachable when tarfile extracts a link on a system that does not support links and therefore falls back to extracting the linked member from the archive.

What must an attacker provide to exploit the issue?

An attacker would need an archive containing a link that triggers the no-link-support fallback during extraction. The issue concerns custom extraction filters that return None to skip a member.

Why might a custom extraction filter fail to block extraction?

During the fallback, the filter is called twice: for the extracted member and for the link location. One return value was ignored, so a member could be extracted even when one of those filter calls returned None.

What behavior should be expected after the fix?

The member should be skipped if either of the two filter calls returns None.