Skip to content

tarfile.extractall(filter='data') allows symlink escape through hardlink-extraction fallback #151558

Closed
Closed
tarfile.extractall(filter='data') allows symlink escape through hardlink-extraction fallback#151558
Assignees
StanFromIreland
Labels
3.10 (EOL)end of life3.11only security fixes3.12only security fixes3.13only security fixes3.14bugs and security fixes3.15bugs and security fixes3.16new features, bugs and security fixesstdlibStandard Library Python modules in the Lib/ directorytype-securityA security issue

Description

@StanFromIreland
StanFromIreland
opened on Jun 16, 2026

More details to follow - patience is bitter, but its fruit is sweet. ;-)

Linked PRs

Activity

  1. pablogsal
    added a commit that references this issue on Jun 27, 2026

    [3.11] gh-151558: Fix symlink escape via `tarfile` hardlink-extractio…

    be13e86
  2. pyctrl
    added a commit that references this issue on Jul 5, 2026

    pythongh-151558: Fix symlink escape via `tarfile` hardlink-extraction…

    eb8994a
  3. octo-sts-6
    added a commit that references this issue on Jul 13, 2026

    fix(python): remediate CVE-2026-4360, CVE-2026-11940, CVE-2026-11972 …

    a022f3c
  4. Yhg1s
    added a commit that references this issue on Aug 4, 2026

    [3.12] gh-151558: Fix symlink escape via `tarfile` hardlink-extractio…

    e5fdbd8

  5. uberDoward commented on Aug 4, 2026

    @uberDoward
    uberDoward
    on Aug 4, 2026 · Hidden as low-quality
  6. pablogsal
    added a commit that references this issue on Aug 10, 2026

    [3.10] gh-151558: Fix symlink escape via `tarfile` hardlink-extractio…

    0f852b3
  7. StanFromIreland
    closed this as completedon Aug 10, 2026
  8. github-project-automation
    moved this to Done in Tarfile issues 🗄️on Aug 10, 2026
  9. bmwiedemann
    added a commit that references this issue on Aug 17, 2026

    Update python313 to version 3.13.14 / rev 44 via SR 1371267

    b2e2336
  10. mcepl
    added 4 commits that reference this issue on Sep 18, 2026

    [CVE-2026-11940] Fix symlink escape via `tarfile` hardlink-extraction…

    f7a1ac3

    [CVE-2026-11940] Fix symlink escape via `tarfile` hardlink-extraction…

    3c4cdfe

    [CVE-2026-11940] Fix symlink escape via `tarfile` hardlink-extraction…

    e218d9b

    [CVE-2026-11940] Fix symlink escape via `tarfile` hardlink-extraction…

    9149262
  11. hroncok
    added a commit that references this issue on Sep 23, 2026

    00492: pythongh-151558: Fix symlink escape via `tarfile` hardlink-ext…

    fe6adb6
  12. mcepl
    added 3 commits that reference this issue on Oct 1, 2026

    [CVE-2026-11940] Fix symlink escape via `tarfile` hardlink-extraction…

    a4de154

    [CVE-2026-11940] Fix symlink escape via `tarfile` hardlink-extraction…

    06209ba

    [CVE-2026-11940] Fix symlink escape via `tarfile` hardlink-extraction…

    9e09b0a
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

3.10 (EOL)end of life3.11only security fixes3.12only security fixes3.13only security fixes3.14bugs and security fixes3.15bugs and security fixes3.16new features, bugs and security fixesstdlibStandard Library Python modules in the Lib/ directorytype-securityA security issue

Projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions