CVE-2026-114583

Name of the Vulnerable Software and Affected Versions Python (affected versions not specified)

Description An issue exists where tarfile.tar filter can be bypassed using specially crafted link entries, such as symlinks with empty or directory-like names. This allows a malicious archive to redirect subsequent members outside the intended extraction directory, enabling the tarfile.extractall() function with filter="tar" to write files to arbitrary locations on the system, depending on the permissions of the process performing the extraction.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.