CVE-2026-82049— tarfile extraction filters allow file modification and content disclosure via hard link to symlink
Quick assessment
Affected
Python Software Foundation CPython
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 CPython 3.13 及更早版本中， 模块的数据过滤器和 tar 解包过滤器易受包含指向符号链接的硬链接的恶意构造归档文件的影响。此类归档文件可能导致解包过程修改目标目录外文件的权限或修改时间，或在解压后的目录树中暴露该文件的内容。
Possible ATT&CK Techniques 1 AI
T1565 · Data ManipulationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Python Software Foundation | CPython | < 3.14.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82049
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
tarfile extraction filters allow file modification and content disclosure via hard link to symlink
Source: CVE Program / CVE List V5
Vulnerability Description
In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
在文件访问前对链接解析不恰当(链接跟随)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Python Software Foundation | CPython | 0 ~ 3.14.0 | - |
|
II. Public POCs for CVE-2026-82049
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82049
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-82049 (2)
Proof of Concept for CVE-2026-82049 (1)
Mailing List Discussions for CVE-2026-82049 (1)
IV. Related Vulnerabilities
Same product: CPython
-
CVE-2026-87910
tarfile hardlink fallback ignores custom extraction filter r -
CVE-2026-15310
zipfile: bzip2/LZMA/Zstandard members decompress without a m -
CVE-2026-19672
tarfile extraction filter bypass allows creation of director -
CVE-2026-15806
`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP -
CVE-2026-17084
stringprep.map_table_b2() deviates from RFC 3454 Table B.2
Same vendor: Python Software Foundation
-
CVE-2026-87910
tarfile hardlink fallback ignores custom extraction filter r -
CVE-2026-15310
zipfile: bzip2/LZMA/Zstandard members decompress without a m -
CVE-2026-19672
tarfile extraction filter bypass allows creation of director -
CVE-2026-15806
`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP -
CVE-2026-17084
stringprep.map_table_b2() deviates from RFC 3454 Table B.2
Same weakness: CWE-59
-
CVE-2026-89021
MikroTik RouterOS Path Traversal via Container OCI/tar Image -
CVE-2026-90807
nanocoai NanoClaw Attachment agent-route.ts forwardAttachedF -
CVE-2026-90930
File Browser through 2.63.23 Path Traversal via Symlink Alia -
CVE-2026-89258
Hugo before v0.165.0 Symlink Confinement Bypass via resource -
CVE-2026-88016
rclone: Directory metadata (chmod/chown/chtimes) applied thr
V. Comments for CVE-2026-82049
No comments yet