CVE-2026-87910

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-87910", "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22", "state": "PUBLISHED", "assignerShortName": "PSF", "dateReserved": "2026-09-09T15:11:08.270Z", "datePublished": "2026-09-11T17:27:04.339Z", "dateUpdated": "2026-10-22T00:31:28.666Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["tarfile"], "product": "CPython", "repo": "https://github.com/python/cpython", "vendor": "Python Software Foundation", "versions": [{"version": "0", "lessThan": "3.10.22", "status": "affected", "versionType": "python"}, {"version": "3.11.0", "lessThan": "3.11.17", "status": "affected", "versionType": "python"}, {"version": "3.12.0", "lessThan": "3.12.15", "status": "affected", "versionType": "python"}, {"version": "3.13.0", "lessThan": "3.13.16", "status": "affected", "versionType": "python"}, {"version": "3.14.0", "lessThan": "3.14.9", "status": "affected", "versionType": "python"}, {"version": "3.15.0a1", "lessThan": "3.15.0rc3", "status": "affected", "versionType": "python"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "William Woodruff (https://github.com/woodruffw)"}, {"lang": "en", "type": "finder", "value": "Zanie Blue (https://github.com/zanieb)"}, {"lang": "en", "type": "coordinator", "value": "Petr Viktorin (https://github.com/encukou)"}, {"lang": "en", "type": "remediation reviewer", "value": "Stan Ulbrych (https://github.com/StanFromIreland)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None."}], "value": "When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 5.7, "baseSeverity": "MEDIUM", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "CWE-22", "lang": "en", "type": "CWE"}, {"cweId": "CWE-59", "description": "CWE-59", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "28c92f92-d60d-412d-b760-e73465c3df22", "shortName": "PSF", "dateUpdated": "2026-10-22T00:31:28.666Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/pull/157266"}, {"tags": ["issue-tracking"], "url": "https://github.com/python/cpython/issues/157265"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/764fd0af8d9e19d3684a58d2e58bf770f0605036"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/2eb0c2f1dc71847731b6ab30aebefd058d482a7f"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/c1f106d240c4ffcb3608ed0a20e8aba6c865f6d3"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/3105a3498aaf681ce128cf5baf83c2e5574267c5"}, {"tags": ["patch"], "url": "https://github.com/python/cpython/commit/a4919937a4e1e69a0d178909c6f20557eca5d1d0"}], "source": {"discovery": "UNKNOWN"}, "title": "tarfile hardlink fallback ignores custom extraction filter rejection via None", "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-11T19:23:39.973519Z", "id": "CVE-2026-87910", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-11T19:23:49.726Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/09/11/8"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-09-11T21:07:14.642Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/09/11/8"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-09-11T21:07:14.642Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-87910", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-11T19:23:39.973519Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-11T19:23:45.511Z"}}], "cna": {"title": "tarfile hardlink fallback ignores custom extraction filter rejection via None", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "William Woodruff (https://github.com/woodruffw)"}, {"lang": "en", "type": "finder", "value": "Zanie Blue (https://github.com/zanieb)"}, {"lang": "en", "type": "coordinator", "value": "Petr Viktorin (https://github.com/encukou)"}, {"lang": "en", "type": "remediation reviewer", "value": "Stan Ulbrych (https://github.com/StanFromIreland)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/python/cpython", "vendor": "Python Software Foundation", "modules": ["tarfile"], "product": "CPython", "versions": [{"status": "affected", "version": "0", "lessThan": "3.10.22", "versionType": "python"}, {"status": "affected", "version": "3.11.0", "lessThan": "3.11.17", "versionType": "python"}, {"status": "affected", "version": "3.12.0", "lessThan": "3.12.15", "versionType": "python"}, {"status": "affected", "version": "3.13.0", "lessThan": "3.13.16", "versionType": "python"}, {"status": "affected", "version": "3.14.0", "lessThan": "3.14.9", "versionType": "python"}, {"status": "affected", "version": "3.15.0a1", "lessThan": "3.15.0rc3", "versionType": "python"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/", "tags": ["vendor-advisory"]}, {"url": "https://github.com/python/cpython/pull/157266", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/issues/157265", "tags": ["issue-tracking"]}, {"url": "https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/commit/764fd0af8d9e19d3684a58d2e58bf770f0605036", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/commit/2eb0c2f1dc71847731b6ab30aebefd058d482a7f", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/commit/c1f106d240c4ffcb3608ed0a20e8aba6c865f6d3", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/commit/3105a3498aaf681ce128cf5baf83c2e5574267c5", "tags": ["patch"]}, {"url": "https://github.com/python/cpython/commit/a4919937a4e1e69a0d178909c6f20557eca5d1d0", "tags": ["patch"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.", "supportingMedia": [{"type": "text/html", "value": "When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22"}, {"lang": "en", "type": "CWE", "cweId": "CWE-59", "description": "CWE-59"}]}], "providerMetadata": {"orgId": "28c92f92-d60d-412d-b760-e73465c3df22", "shortName": "PSF", "dateUpdated": "2026-10-22T00:31:28.666Z"}}}, "cveMetadata": {"cveId": "CVE-2026-87910", "state": "PUBLISHED", "dateUpdated": "2026-10-22T00:31:28.666Z", "dateReserved": "2026-09-09T15:11:08.270Z", "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22", "datePublished": "2026-09-11T17:27:04.339Z", "assignerShortName": "PSF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["tarfile"], "product": "CPython", "repo": "https://github.com/python/cpython", "vendor": "Python Software Foundation", "versions": [{"lessThan": "3.10.22", "status": "affected", "version": "0", "versionType": "python"}, {"lessThan": "3.11.17", "status": "affected", "version": "3.11.0", "versionType": "python"}, {"lessThan": "3.12.15", "status": "affected", "version": "3.12.0", "versionType": "python"}, {"lessThan": "3.13.16", "status": "affected", "version": "3.13.0", "versionType": "python"}, {"lessThan": "3.14.9", "status": "affected", "version": "3.14.0", "versionType": "python"}, {"lessThan": "3.15.0rc3", "status": "affected", "version": "3.15.0a1", "versionType": "python"}]}], "source": "cna@python.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None."}], "id": "CVE-2026-87910", "lastModified": "2026-10-22T01:16:59.773", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@python.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-87910", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-11T19:23:39.973519Z", "version": "2.0.3"}}]}, "published": "2026-09-11T18:16:59.800", "references": [{"source": "cna@python.org", "url": "https://github.com/python/cpython/commit/2eb0c2f1dc71847731b6ab30aebefd058d482a7f"}, {"source": "cna@python.org", "url": "https://github.com/python/cpython/commit/3105a3498aaf681ce128cf5baf83c2e5574267c5"}, {"source": "cna@python.org", "url": "https://github.com/python/cpython/commit/764fd0af8d9e19d3684a58d2e58bf770f0605036"}, {"source": "cna@python.org", "url": "https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955"}, {"source": "cna@python.org", "url": "https://github.com/python/cpython/commit/a4919937a4e1e69a0d178909c6f20557eca5d1d0"}, {"source": "cna@python.org", "url": "https://github.com/python/cpython/commit/c1f106d240c4ffcb3608ed0a20e8aba6c865f6d3"}, {"source": "cna@python.org", "url": "https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b"}, {"source": "cna@python.org", "url": "https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2"}, {"source": "cna@python.org", "url": "https://github.com/python/cpython/issues/157265"}, {"source": "cna@python.org", "url": "https://github.com/python/cpython/pull/157266"}, {"source": "cna@python.org", "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/09/11/8"}], "sourceIdentifier": "cna@python.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-59"}], "source": "cna@python.org", "type": "Secondary"}]}

{"bugzilla": {"description": "python: Python tarfile module: Security filter bypass allows arbitrary file write", "id": "2531985", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531985"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N", "status": "draft"}, "cwe": "CWE-252", "details": ["A flaw was found in the Python `tarfile` module. When extracting an archive containing a link on systems that do not support links, the module falls back to extracting the linked member. During this fallback, a security filter designed to prevent the extraction of certain files is not properly applied. This oversight could allow an attacker to bypass intended security restrictions, potentially leading to the creation or modification of arbitrary files on the system."], "name": "CVE-2026-87910", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "hi/python", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "python3.10", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "python3.11", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "python3.12", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "python3.13", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "python3.14", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-09-11T17:27:04Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-87910\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-87910\nhttps://github.com/python/cpython/issues/157265\nhttps://github.com/python/cpython/pull/157266\nhttps://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.15.0)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "CPython", "source": "cna", "vendor": "Python Software Foundation"}, "product": "cpython", "vendor": "python"}], "created": "2026-09-12T22:00:07.582876+00:00", "updated": "2026-09-21T04:30:08.557313+00:00", "vendors": ["python", "python$PRODUCT$cpython"]}