tarfile hardlink fallback ignores custom extraction filter rejection via None
Summary
| CVE | CVE-2026-87910 |
|---|---|
| State | PUBLISHED |
| Assigner | PSF |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-11 18:16:59 UTC |
| Updated | 2026-09-11 18:16:59 UTC |
| Description | When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None. |
Risk And Classification
Primary CVSS: v4.0 5.7 MEDIUM from [email protected]
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Problem Types: CWE-22 | CWE-59 | CWE-22 CWE-22 | CWE-59 CWE-59
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 5.7 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 5.7 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
CVSS v4.0 Breakdown
Attack Vector
NetworkAttack Complexity
LowAttack Requirements
PresentPrivileges Required
LowUser Interaction
ActiveConfidentiality
NoneIntegrity
HighAvailability
NoneSub Conf.
NoneSub Integrity
NoneSub Availability
NoneCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Python Software Foundation | CPython | affected 3.16.0 python | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/python/cpython/pull/157266 | [email protected] | github.com | |
| mail.python.org/archives/list/[email protected]/thread/57TBTLL2W6A... | [email protected] | mail.python.org | |
| github.com/python/cpython/issues/157265 | [email protected] | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: William Woodruff (https://github.com/woodruffw) (en)
CNA: Zanie Blue (https://github.com/zanieb) (en)
CNA: Petr Viktorin (https://github.com/encukou) (en)
CNA: Stan Ulbrych (https://github.com/StanFromIreland) (en)
There are currently no legacy QID mappings associated with this CVE.