CVE-2026-7774— Python 安全漏洞

tarfile.data_filter path traversal bypass allows writing outside the extraction directory

tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process.

N/A

对路径名的限制不恰当(路径遍历)

Python 安全漏洞

Python是Python基金会的一套开源的、面向对象的程序设计语言。该语言具有可扩展、支持模块和包、支持多种平台等特点。 Python存在安全漏洞，该漏洞源于tarfile.data_filter可通过特制链接条目绕过，包括空名称或目录类符号链接，导致tarfile.extractall将文件写入目标目录之外。

N/A

N/A