CVE-2026-114583 in Python
Summary
by MITRE • 10/22/2026
tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter="tar" to write files outside the destination directory, subject to the permissions of the extracting process.
This is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in this advisory represents a critical bypass of security controls implemented within Python's standard library tarfile module, specifically affecting the tar_filter function introduced as part of enhanced archive extraction safeguards. This flaw allows an attacker to craft malicious TAR archives that can redirect file extractions outside of the intended destination directory, effectively neutralizing the protective measures designed to prevent path traversal attacks during untrusted archive processing. The core technical issue stems from insufficient validation logic within the filtering mechanism when handling specific types of link entries, particularly symbolic links and hard links with empty or directory-like names. By exploiting these edge cases in name parsing and resolution, an adversary can manipulate the internal state of the extraction process to write files into arbitrary locations on the file system where the extracting process holds sufficient permissions.
From a technical perspective, the vulnerability arises because the tar_filter function does not adequately sanitize or validate link targets that appear benign but are constructed to resolve to paths outside the root directory specified for extraction. When an archive contains symbolic links with empty names or names structured to mimic directories, the filtering logic may fail to correctly calculate the absolute path of the target file relative to the extraction base. This miscalculation allows subsequent members in the archive stream to be written to unintended locations. The severity is compounded by the fact that this bypass applies specifically when users explicitly opt into the stricter tar filter mode via extractall with filter="tar". Despite this explicit security configuration, the flaw renders the protection ineffective against crafted inputs, demonstrating a failure in defensive coding practices regarding path normalization and boundary checks for link resolution operations.
The operational impact of this vulnerability is significant, particularly for applications that process user-uploaded TAR archives or automate extraction tasks involving untrusted data sources. An attacker who can supply such a malicious archive could achieve arbitrary file write capabilities on the host system, subject only to the permissions of the executing Python process. This capability enables a range of downstream attacks including but not limited to overwriting critical configuration files, injecting malicious scripts into executable directories, or compromising application integrity by modifying source code or libraries. In environments where services run with elevated privileges, such as web servers running under root or system accounts, this vulnerability could lead to full remote code execution and complete compromise of the underlying infrastructure. The risk is further amplified in containerized environments if the extraction occurs within a privileged container that lacks proper volume isolation.
This flaw aligns closely with Common Weakness Enumeration CWE-22 Improper Limitation of a Pathname to a Restricted Directory, as it involves failing to restrict file operations to an intended directory structure. Additionally, it relates to CWE-59 Improper Link Resolution Before File Access, commonly known as Time-of-check to Time-of-use (TOCTOU) issues or link resolution flaws where the security check does not account for dynamic changes in path interpretation during extraction. In terms of MITRE ATT&CK mapping, this vulnerability facilitates techniques associated with Initial Access and Persistence through malicious archive delivery and file manipulation, specifically aligning with T1059 Command and Scripting Interpreter if used to place scripts or T1486 Data Encrypted for Impact if leveraged in ransomware scenarios. The counterpart nature of CVE-2026-7774 indicates that similar logic flaws existed in the data_filter function, suggesting a systemic need for rigorous review of all archive parsing components within the library.
Mitigation strategies must prioritize immediate patching to update the Python installation or environment to versions where this filtering bypass has been corrected by developers through stricter validation of link targets and enhanced path normalization routines. For systems unable to upgrade immediately, defensive coding practices should be employed such as validating extracted paths against a whitelist of allowed directories before any file system operations occur. Developers should also consider implementing additional sandboxing mechanisms like chroot jails or Linux namespaces to limit the blast radius if an archive extraction is compromised. Furthermore, input validation at the application layer can help detect anomalous TAR structures by inspecting member names and link targets prior to passing them to the tarfile module. Regular security audits of code handling untrusted archives are essential to identify similar vulnerabilities in custom parsing logic that may not benefit from library-level fixes.