tarfile.extractall(filter='data') allows symlink escape through hardlink-extraction fallback #151558

Activity

1. StanFromIreland

   self-assigned this

   on Jun 16, 2026
2. StanFromIreland

   added this to Tarfile issues 🗄️on Jun 16, 2026
3. StanFromIreland

   added

   type-securityA security issueA security issue

   stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directory

   3.11only security fixesonly security fixes

   3.10 (EOL)end of lifeend of life

   3.12only security fixesonly security fixes

   3.13only security fixesonly security fixes

   3.14bugs and security fixesbugs and security fixes

   3.15bugs and security fixesbugs and security fixes

   3.16new features, bugs and security fixesnew features, bugs and security fixes

   on Jun 16, 2026
4. encukou

   added a commit that references this issue on Jun 23, 2026

   gh-151558: Fix symlink escape via `tarfile` hardlink-extraction fallb…

   ...

   27dd970
5. StanFromIreland

   added 3 commits that reference this issue on Jun 23, 2026

   [3.13] gh-151558: Fix symlink escape via `tarfile` hardlink-extractio…

   ...

   771d12d

   [3.14] gh-151558: Fix symlink escape via `tarfile` hardlink-extractio…

   ...

   79c06bd

   [3.15] gh-151558: Fix symlink escape via `tarfile` hardlink-extractio…

   ...

   672825e
6. 2 remaining items

   Load more
7. octo-sts-6

   added a commit that references this issue on Jul 13, 2026

   fix(python): remediate CVE-2026-4360, CVE-2026-11940, CVE-2026-11972 …

   ...

   a022f3c
8. Yhg1s

   added a commit that references this issue on Aug 4, 2026

   [3.12] gh-151558: Fix symlink escape via `tarfile` hardlink-extractio…

   ...

   e5fdbd8
9. uberDoward commented on Aug 4, 2026

   

   uberDoward

   on Aug 4, 2026 · Hidden as low-quality

   show commentMore actions
10. pablogsal

    added a commit that references this issue on Aug 10, 2026

    [3.10] gh-151558: Fix symlink escape via `tarfile` hardlink-extractio…

    ...

    0f852b3
11. StanFromIreland

    closed this as completedon Aug 10, 2026
12. github-project-automation

    moved this to Done in Tarfile issues 🗄️on Aug 10, 2026
13. bmwiedemann

    added a commit that references this issue on Aug 17, 2026

    Update python313 to version 3.13.14 / rev 44 via SR 1371267

    ...

    b2e2336
14. mcepl

    added 4 commits that reference this issue on Sep 18, 2026

    [CVE-2026-11940] Fix symlink escape via `tarfile` hardlink-extraction…

    ...

    f7a1ac3

    [CVE-2026-11940] Fix symlink escape via `tarfile` hardlink-extraction…

    ...

    3c4cdfe

    [CVE-2026-11940] Fix symlink escape via `tarfile` hardlink-extraction…

    ...

    e218d9b

    [CVE-2026-11940] Fix symlink escape via `tarfile` hardlink-extraction…

    ...

    9149262
15. hroncok

    added a commit that references this issue on Sep 23, 2026

    00492: pythongh-151558: Fix symlink escape via `tarfile` hardlink-ext…

    ...

    fe6adb6
16. mcepl

    added 3 commits that reference this issue on Oct 1, 2026

    [CVE-2026-11940] Fix symlink escape via `tarfile` hardlink-extraction…

    ...

    a4de154

    [CVE-2026-11940] Fix symlink escape via `tarfile` hardlink-extraction…

    ...

    06209ba

    [CVE-2026-11940] Fix symlink escape via `tarfile` hardlink-extraction…

    ...

    9e09b0a