CPython: [CVE-2026-87910] tarfile hardlink fallback ignores custom extraction filter rejection via None

As cited

Copy frozen at 2026-09-11 21:53 UTC (site build).

vulnerabilities

CPython: [CVE-2026-87910] tarfile hardlink fallback ignores custom extraction filter rejection via None

CVE-2026-87910 affects Python's tarfile module, where a hardlink fallback mechanism bypasses custom extraction filter rejections when a filter returns None. An attacker could potentially extract files outside intended directories during tarfile handling.

Why it matters: Development teams and system administrators using Python's tarfile module with custom extraction filters need to apply patches to prevent directory traversal or unintended file extraction in applications that process untrusted tar archives.

Source published

2026-09-11 19:20 UTC

First seen by Cybersecurity Tracker

2026-09-11 21:31 UTC