CPython: [CVE-2026-114583] tarfile.tar_filter path traversal bypass allows writing outside the extraction directory

As cited

Copy frozen at 2026-10-23 01:07 UTC (site build).

vulnerabilities

CPython: [CVE-2026-114583] tarfile.tar_filter path traversal bypass allows writing outside the extraction directory

CPython's tarfile.tar_filter module contains a path traversal vulnerability that allows an attacker to write files outside the intended extraction directory. The issue was disclosed on October 22, 2026, and assigned CVE-2026-114583.

Why it matters: Python developers and users who extract tar archives with untrusted content face the risk of arbitrary file writes to the filesystem; patching CPython is necessary to prevent potential system compromise.

Source published

2026-10-22 22:47 UTC

First seen by Cybersecurity Tracker

2026-10-23 00:11 UTC