-------- Forwarded Message --------
Subject: [Security-announce][CVE-2026-87910] tarfile hardlink fallback ignores
custom extraction filter rejection via None
Date: Fri, 11 Sep 2026 14:24:10 +0200
From: Petr Viktorin via Security-announce <[email protected]>
Reply-To: [email protected]
To: [email protected]
CC: Petr Viktorin <[email protected]>
There is a MEDIUM severity vulnerability affecting CPython.
When tarfile extracts a link on a system that doesn't support links, it
falls back to extracting a member from the archive. In this case, the
filter function is run twice: once for the extracted member, and once
with name set to the location of the link.
For one of the calls, the return value was ignored. Instead, the member
should be skipped if either call returns None.
Please see the linked CVE ID for the latest information on affected
versions:
* https://www.cve.org/CVERecord?id=CVE-2026-87910
* https://github.com/python/cpython/pull/157266
_______________________________________________
Security-announce mailing list -- [email protected]
https://mail.python.org/mailman3//lists/security-announce.python.org
