CVE-2026-11940— tarfile extraction filter bypass allows escaping the destination directory
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-11940
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
tarfile extraction filter bypass allows escaping the destination directory
Source: NVD (National Vulnerability Database)
Vulnerability Description
tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory. This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Python Software Foundation | CPython | 0 ~ 3.15.0 | - |
II. Public POCs for CVE-2026-11940
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-11940
请登录查看更多情报信息。
Other References for CVE-2026-11940 (7)
Same Patch Batch · Python Software Foundation · 2026-06-23 · 3 CVEs total
| CVE-2026-0864 | Configuration Injection via Carriage Return (\r) in write() method | |
| CVE-2026-11972 | tarfile opened in streaming mode mishandles EOF |
IV. Related Vulnerabilities
Same product: CPython
- CVE-2026-11972
tarfile opened in streaming mode mishandles EOF - CVE-2026-0864
Configuration Injection via Carriage Return (\r) in write() - CVE-2026-12003
CPython >3.11 Insecure Input Validation resulting in privile - CVE-2026-9669
bz2.BZ2Decompressor reuse after error can cause a stack buff - CVE-2026-7774
tarfile.data_filter path traversal bypass allows writing out
Same vendor: Python Software Foundation
- CVE-2026-11972
tarfile opened in streaming mode mishandles EOF - CVE-2026-0864
Configuration Injection via Carriage Return (\r) in write() - CVE-2026-12003
CPython >3.11 Insecure Input Validation resulting in privile - CVE-2026-9669
bz2.BZ2Decompressor reuse after error can cause a stack buff - CVE-2026-7774
tarfile.data_filter path traversal bypass allows writing out
Same weakness: CWE-22
- CVE-2026-54557
mise HTTP backend uses raw version path for install symlink - CVE-2026-56876
extract-zip unvalidated symlink path traversal - CVE-2026-55677
Echo: Encoded slash (%2F) bypasses route-level protection an - CVE-2026-57321
WordPress H5P plugin <= 1.17.7 - Arbitrary File Deletion vul - CVE-2026-56066
WordPress ShortPixel Adaptive Images plugin <= 3.11.4 - Arbi
V. Comments for CVE-2026-11940
No comments yet