VULNERABILITY INTELLIGENCE
CVE-2026-82049
EPSS probability0.19%
CISA KEVNot currently listed
Published2026-09-14
Last modified2026-10-11
Description
In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.
Weakness classification
- cna@python.org: CWE-59