CVE-2026-4360

MediumCVSS 5.3/10Last modified Oct 25, 2026

Description

In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-281

Affected software

VendorProductVersions
Python Software FoundationCPython< 3.10.21; >= 3.11.0, < 3.11.16; >= 3.12.0, < 3.12.14; >= 3.13.0, < 3.13.15; >= 3.14.0, < 3.14.7; >= 3.15.0a1, < 3.15.0b4

References

Timeline

Published
Jun 30, 2026
Last modified
Oct 25, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-436036.9A NULL pointer dereference in the Linux GPU driver could potentially lead to a kernel crash and result in denial of service.CVE-2026-436068.5Observable Timing Discrepancy in the AMD Vitis Libraries ECDSA secp256k1 component could allow attackers with local access to potentially peCVE-2026-43615.0The Divi theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.27.6. This is due to the `CVE-2026-436167.8Detect-It-Easy prior to 3.21 contains a path traversal vulnerability that allows attackers to write arbitrary files to the filesystem by craCVE-2026-436174.8Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforceCVE-2026-436188.1Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is notCVE-2026-436196.3Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, renCVE-2026-43626.5The ElementsKit Elementor Addons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check oCVE-2026-436205.5Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in recv_files() in receiver.c that allows a malCVE-2026-436218.1Simple Machines Forum (SMF) through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vulnerability in the profile lCVE-2026-436227.8llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new_1batch() allocates memorCVE-2026-436238.8microtar through 0.1.0 contains a stack-based buffer overflow vulnerability in the raw_to_header() function in src/microtar.c that allows at