Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-11940

tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself.  The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory.  This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:d6b718e7809f181f1010239b425ca869df22eb3f2fcfb156ba48e127afe826f3
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

cwe · 2 assertions

{"cweId":"CWE-22","description":"CWE-22","lang":"en","type":"CWE"}

  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:ca00991f872a3fb0873c21c8efb5ab7ac36aa1a6b9fadaf3a17f2f645ebcd129 · sha256:da31d018a03433d1… · /containers/cna/problemTypes/0/descriptions/0

{"cweId":"CWE-59","description":"CWE-59","lang":"en","type":"CWE"}

  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:ca00991f872a3fb0873c21c8efb5ab7ac36aa1a6b9fadaf3a17f2f645ebcd129 · sha256:da31d018a03433d1… · /containers/cna/problemTypes/1/descriptions/0

Affected products and versions

1 source assertion
{"defaultStatus":"unaffected","product":"CPython","repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","versions":[{"lessThan":"3.15.0b4","status":"affected","version":"0","versionType":"python"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:ca00991f872a3fb0873c21c8efb5ab7ac36aa1a6b9fadaf3a17f2f645ebcd129 · sha256:da31d018a03433d1… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":7.8,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"…
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:ca00991f872a3fb0873c21c8efb5ab7ac36aa1a6b9fadaf3a17f2f645ebcd129 · sha256:da31d018a03433d1… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

2 source assertions
{"cweId":"CWE-22","description":"CWE-22","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:ca00991f872a3fb0873c21c8efb5ab7ac36aa1a6b9fadaf3a17f2f645ebcd129 · sha256:da31d018a03433d1… · /containers/cna/problemTypes/0/descriptions/0
{"cweId":"CWE-59","description":"CWE-59","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:ca00991f872a3fb0873c21c8efb5ab7ac36aa1a6b9fadaf3a17f2f645ebcd129 · sha256:da31d018a03433d1… · /containers/cna/problemTypes/1/descriptions/0

Source references

8 source assertions
{"tags":["patch"],"url":"https://github.com/python/cpython/commit/27dd970bf6b17ebca7c8ed486a40ab043ed7af8f"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:ca00991f872a3fb0873c21c8efb5ab7ac36aa1a6b9fadaf3a17f2f645ebcd129 · sha256:da31d018a03433d1… · /containers/cna/references/3
{"tags":["patch"],"url":"https://github.com/python/cpython/commit/672825e2f36a57e173959b0d9d409d4560dab8df"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:ca00991f872a3fb0873c21c8efb5ab7ac36aa1a6b9fadaf3a17f2f645ebcd129 · sha256:da31d018a03433d1… · /containers/cna/references/4
{"tags":["patch"],"url":"https://github.com/python/cpython/commit/771d12dda5140313db0ac550292987975651bbde"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:ca00991f872a3fb0873c21c8efb5ab7ac36aa1a6b9fadaf3a17f2f645ebcd129 · sha256:da31d018a03433d1… · /containers/cna/references/5
{"tags":["patch"],"url":"https://github.com/python/cpython/commit/79c06bd5c6afa3c440d50faf7ee1b147c8832b4c"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:ca00991f872a3fb0873c21c8efb5ab7ac36aa1a6b9fadaf3a17f2f645ebcd129 · sha256:da31d018a03433d1… · /containers/cna/references/6
{"tags":["patch"],"url":"https://github.com/python/cpython/commit/be13e86f6b9788a6f4d0419dffef72cbae5865c9"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:ca00991f872a3fb0873c21c8efb5ab7ac36aa1a6b9fadaf3a17f2f645ebcd129 · sha256:da31d018a03433d1… · /containers/cna/references/7
{"tags":["issue-tracking"],"url":"https://github.com/python/cpython/issues/151558"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:ca00991f872a3fb0873c21c8efb5ab7ac36aa1a6b9fadaf3a17f2f645ebcd129 · sha256:da31d018a03433d1… · /containers/cna/references/2
{"tags":["patch"],"url":"https://github.com/python/cpython/pull/151559"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:ca00991f872a3fb0873c21c8efb5ab7ac36aa1a6b9fadaf3a17f2f645ebcd129 · sha256:da31d018a03433d1… · /containers/cna/references/0
{"tags":["vendor-advisory"],"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:ca00991f872a3fb0873c21c8efb5ab7ac36aa1a6b9fadaf3a17f2f645ebcd129 · sha256:da31d018a03433d1… · /containers/cna/references/1

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer