CVE-2026-82049

HighCVSS 8.4/10Last modified Oct 11, 2026

Description

In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.

Metrics

CVSS 4.0 8.4/10

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-59

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 14, 2026
Last modified: Oct 11, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-82055.3Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block since action_get_events does not check canView on t CVE-2026-820526.5The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server (mongod)CVE-2026-820538.1A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities CVE-2026-820546.5A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command include CVE-2026-820556.5A security issue exists in MongoDB's 2dsphere index key generation that can cause a server crash due to a null pointer dereference. When a s CVE-2026-820565.3A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert retry paths. Under c CVE-2026-820576.5A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By s CVE-2026-820586.5A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges to crash the mongod CVE-2026-820596.5An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being re CVE-2026-82069.8The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeo CVE-2026-820605.4In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specia CVE-2026-820618.1A use-after-free security issue exists in the server's query execution memory tracking subsystem. An authenticated user with read privileges