CVE-2026-4360

Name of the Vulnerable Software and Affected Versions Python (affected versions not specified)

Description In the extract() function of the Tarfile module, the filter parameter is not correctly handled when extracting hardlinks. This issue allows a system extracting content from untrusted tar files to write files with an unexpected uid/gid, even when the user has specified filter='data' to restrict the extraction process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.