CVE-2026-82049

Name of the Vulnerable Software and Affected Versions CPython versions prior to 3.14

Description The tarfile module's data and extraction filters are susceptible to a bypass when processing crafted archives containing a hard link that targets a symbolic link. This issue occurs during the execution of the extractall() function, potentially allowing an attacker to modify the permissions or modification time of files located outside the intended destination directory. Additionally, it may lead to the exposure of the contents of such files within the extracted directory tree. Non-link entries are not affected.

Recommendations Update to a version later than 3.13.