Python tarfile up to 3.15.x path traversal

Summaryinfo

A vulnerability was found in Python tarfile up to 3.15.x. It has been classified as problematic. This affects an unknown function. This manipulation causes path traversal. This vulnerability is handled as CVE-2026-19672. It is possible to launch the attack on the local host. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Python tarfile up to 3.15.x. It has been declared as problematic. Affected by this vulnerability is an unknown code block. The manipulation with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given. Only empty directories are created outside the destination. Member contents are still extracted inside it. To return to the destination the member's name must contain the destination directory's own final component, so extraction into a secure randomised directory is not affected. This affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-19672 since 08/12/2026. The exploitation appears to be easy. An attack has to be approached locally. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1006 for this issue.

Upgrading to version 3.16.0 eliminates this vulnerability.

The vulnerability is also documented in the databases at EUVD (EUVD-2026-62536) and CERT Bund (WID-SEC-2026-3016). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• Red Hat Enterprise Linux
• Open Source Python

Productinfo

Type

• Programming Language Software

Vendor

• Python

Name

• tarfile

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12
• 3.13
• 3.14
• 3.15

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion