CVE-2026-82049

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-82049", "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22", "state": "PUBLISHED", "assignerShortName": "PSF", "dateReserved": "2026-08-27T22:23:05.514Z", "datePublished": "2026-09-14T19:14:03.873Z", "dateUpdated": "2026-10-11T00:39:42.376Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["tarfile"], "product": "CPython", "repo": "https://github.com/python/cpython", "vendor": "Python Software Foundation", "versions": [{"version": "0", "lessThan": "3.10.22", "status": "affected", "versionType": "python"}, {"version": "3.11.0", "lessThan": "3.11.17", "status": "affected", "versionType": "python"}, {"version": "3.12.0", "lessThan": "3.12.15", "status": "affected", "versionType": "python"}, {"version": "3.13.0", "lessThan": "3.13.16", "status": "affected", "versionType": "python"}, {"version": "3.14.0a1", "lessThan": "3.14.0b1", "status": "affected", "versionType": "python"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Jing Qian (https://github.com/Civitasmass)"}, {"lang": "en", "type": "coordinator", "value": "Stan Ulbrych (https://github.com/StanFromIreland)"}, {"lang": "en", "type": "remediation reviewer", "value": "Petr Viktorin (https://github.com/encukou)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"type": "text/html", "value": "In CPython 3.13 and earlier, the <span>tarfile</span>&nbsp;module's <span>data</span>&nbsp;and <span>tar</span> extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree."}], "value": "In CPython 3.13 and earlier, the tarfile\u00a0module's data\u00a0and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "baseScore": 8.4, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-59", "description": "CWE-59", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "28c92f92-d60d-412d-b760-e73465c3df22", "shortName": "PSF", "dateUpdated": "2026-10-11T00:39:42.376Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/python/cpython/commit/5a57248b22ad3b9aafcaaadae2c304a1923daeca"}, {"tags": ["issue-tracking"], "url": "https://github.com/python/cpython/issues/157190"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/pull/157191"}, {"tags": ["vendor-advisory"], "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/EFJWGAZJA56AKSBR2WHMHQZO7RRLZPRH/"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/b38be2e6cf9d989075ab73412c63e003ebad4ff3"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/b8f23e307097552eaea2604383a12ab280520d0d"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/197663d63afed27f66e10e23c194e8a634e60913"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/28f315486b3da0352b9a1de1c3c97f4127ba4771"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/c66df4e70435d257fd488b35ea129c6f317433a8"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/cc1689830c6b9aaddded2fb9f2fe8116867e2c0e"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/cccc7ec30212dba2abef53ce4a2bed112ddb690c"}], "source": {"discovery": "UNKNOWN"}, "title": "tarfile extraction filters allow file modification and content disclosure via hard link to symlink", "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-15T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-82049"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-16T03:56:12.084Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/09/14/27"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-09-14T20:07:50.158Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/09/14/27"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-09-14T20:07:50.158Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-82049", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-14T19:42:40.262634Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-14T19:42:47.686Z"}}], "cna": {"title": "tarfile extraction filters allow file modification and content disclosure via hard link to symlink", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Jing Qian (https://github.com/Civitasmass)"}, {"lang": "en", "type": "coordinator", "value": "Stan Ulbrych (https://github.com/StanFromIreland)"}, {"lang": "en", "type": "remediation reviewer", "value": "Petr Viktorin (https://github.com/encukou)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/python/cpython", "vendor": "Python Software Foundation", "modules": ["tarfile"], "product": "CPython", "versions": [{"status": "affected", "version": "0", "lessThan": "3.10.22", "versionType": "python"}, {"status": "affected", "version": "3.11.0", "lessThan": "3.11.17", "versionType": "python"}, {"status": "affected", "version": "3.12.0", "lessThan": "3.12.15", "versionType": "python"}, {"status": "affected", "version": "3.13.0", "lessThan": "3.13.16", "versionType": "python"}, {"status": "affected", "version": "3.14.0a1", "lessThan": "3.14.0b1", "versionType": "python"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/python/cpython/commit/5a57248b22ad3b9aafcaaadae2c304a1923daeca", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/issues/157190", "tags": ["issue-tracking"]}, {"url": "https://github.com/python/cpython/pull/157191", "tags": ["patch"]}, {"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/EFJWGAZJA56AKSBR2WHMHQZO7RRLZPRH/", "tags": ["vendor-advisory"]}, {"url": "https://github.com/python/cpython/commit/b38be2e6cf9d989075ab73412c63e003ebad4ff3", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/commit/b8f23e307097552eaea2604383a12ab280520d0d", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/commit/197663d63afed27f66e10e23c194e8a634e60913", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/commit/28f315486b3da0352b9a1de1c3c97f4127ba4771", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/commit/c66df4e70435d257fd488b35ea129c6f317433a8", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/commit/cc1689830c6b9aaddded2fb9f2fe8116867e2c0e", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/commit/cccc7ec30212dba2abef53ce4a2bed112ddb690c", "tags": ["patch"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "In CPython 3.13 and earlier, the tarfile\u00a0module's data\u00a0and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.", "supportingMedia": [{"type": "text/html", "value": "In CPython 3.13 and earlier, the <span>tarfile</span>&nbsp;module's <span>data</span>&nbsp;and <span>tar</span> extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree."}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-59", "description": "CWE-59"}]}], "providerMetadata": {"orgId": "28c92f92-d60d-412d-b760-e73465c3df22", "shortName": "PSF", "dateUpdated": "2026-10-11T00:39:42.376Z"}}}, "cveMetadata": {"cveId": "CVE-2026-82049", "state": "PUBLISHED", "dateUpdated": "2026-10-11T00:39:42.376Z", "dateReserved": "2026-08-27T22:23:05.514Z", "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22", "datePublished": "2026-09-14T19:14:03.873Z", "assignerShortName": "PSF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["tarfile"], "product": "CPython", "repo": "https://github.com/python/cpython", "vendor": "Python Software Foundation", "versions": [{"lessThan": "3.10.22", "status": "affected", "version": "0", "versionType": "python"}, {"lessThan": "3.11.17", "status": "affected", "version": "3.11.0", "versionType": "python"}, {"lessThan": "3.12.15", "status": "affected", "version": "3.12.0", "versionType": "python"}, {"lessThan": "3.13.16", "status": "affected", "version": "3.13.0", "versionType": "python"}, {"lessThan": "3.14.0b1", "status": "affected", "version": "3.14.0a1", "versionType": "python"}]}], "source": "cna@python.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In CPython 3.13 and earlier, the tarfile\u00a0module's data\u00a0and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree."}], "id": "CVE-2026-82049", "lastModified": "2026-10-11T01:16:25.820", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@python.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-82049", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-15T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-09-14T19:17:50.927", "references": [{"source": "cna@python.org", "url": "https://github.com/python/cpython/commit/197663d63afed27f66e10e23c194e8a634e60913"}, {"source": "cna@python.org", "url": "https://github.com/python/cpython/commit/28f315486b3da0352b9a1de1c3c97f4127ba4771"}, {"source": "cna@python.org", "url": "https://github.com/python/cpython/commit/5a57248b22ad3b9aafcaaadae2c304a1923daeca"}, {"source": "cna@python.org", "url": "https://github.com/python/cpython/commit/b38be2e6cf9d989075ab73412c63e003ebad4ff3"}, {"source": "cna@python.org", "url": "https://github.com/python/cpython/commit/b8f23e307097552eaea2604383a12ab280520d0d"}, {"source": "cna@python.org", "url": "https://github.com/python/cpython/commit/c66df4e70435d257fd488b35ea129c6f317433a8"}, {"source": "cna@python.org", "url": "https://github.com/python/cpython/commit/cc1689830c6b9aaddded2fb9f2fe8116867e2c0e"}, {"source": "cna@python.org", "url": "https://github.com/python/cpython/commit/cccc7ec30212dba2abef53ce4a2bed112ddb690c"}, {"source": "cna@python.org", "url": "https://github.com/python/cpython/issues/157190"}, {"source": "cna@python.org", "url": "https://github.com/python/cpython/pull/157191"}, {"source": "cna@python.org", "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/EFJWGAZJA56AKSBR2WHMHQZO7RRLZPRH/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/09/14/27"}], "sourceIdentifier": "cna@python.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}], "source": "cna@python.org", "type": "Secondary"}]}

{"bugzilla": {"description": "python: Python tarfile module: File modification and content disclosure via crafted archives", "id": "2533296", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533296"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-59", "details": ["A flaw was found in Python's `tarfile` module. This module's data and tar extraction filters are vulnerable to specially crafted archives containing a hard link to a symbolic link. An attacker could exploit this by providing a malicious archive. This could lead to unauthorized modification of file permissions or modification times for files outside the intended extraction directory, or the disclosure of sensitive file contents within the extracted tree."], "name": "CVE-2026-82049", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "hi/python", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "python3.10", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "python3.11", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "python3.12", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "python3.13", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "python3.14", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-09-14T19:14:03Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-82049\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-82049\nhttps://github.com/python/cpython/commit/5a57248b22ad3b9aafcaaadae2c304a1923daeca\nhttps://github.com/python/cpython/issues/157190\nhttps://github.com/python/cpython/pull/157191\nhttps://mail.python.org/archives/list/security-announce@python.org/thread/EFJWGAZJA56AKSBR2WHMHQZO7RRLZPRH/"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.14.0b1)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "CPython", "source": "cna", "vendor": "Python Software Foundation"}, "product": "cpython", "vendor": "python"}], "created": "2026-09-15T06:00:21.706021+00:00", "updated": "2026-09-20T23:30:07.225330+00:00", "vendors": ["python", "python$PRODUCT$cpython"]}