CVE-2026-87910

Name of the Vulnerable Software and Affected Versions Python tarfile (affected versions not specified)

Description When extracting a link on a system that does not support links, the software falls back to extracting a member from the archive. During this process, the filter function is executed twice: once for the extracted member and once with the name set to the link location. The return value of one of these calls is ignored, whereas the member should be skipped if either call returns None.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.