When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 5.7NVD modified 2026-10-22 01:16
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 12
- https://github.com/python/cpython/commit/2eb0c2f1dc71847731b6ab30aebefd058d482a7f
- https://github.com/python/cpython/commit/3105a3498aaf681ce128cf5baf83c2e5574267c5
- https://github.com/python/cpython/commit/764fd0af8d9e19d3684a58d2e58bf770f0605036
- https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955
- https://github.com/python/cpython/commit/a4919937a4e1e69a0d178909c6f20557eca5d1d0
- https://github.com/python/cpython/commit/c1f106d240c4ffcb3608ed0a20e8aba6c865f6d3
- https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b
- https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2
- https://github.com/python/cpython/issues/157265
- https://github.com/python/cpython/pull/157266
- https://mail.python.org/archives/list/[email protected]/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/
- http://www.openwall.com/lists/oss-security/2026/09/11/8