CVE-2026-4360
Tarfile.extract() doesn't fully respect filter parameter
Description
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
INFO
Published Date :
June 30, 2026, 3:16 p.m.
Last Modified :
July 23, 2026, 7:16 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
Affected Products
The following products are affected by CVE-2026-4360
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | MEDIUM | [email protected] | ||||
| CVSS 4.0 | LOW | 28c92f92-d60d-412d-b760-e73465c3df22 | ||||
| CVSS 4.0 | LOW | [email protected] |
Solution
- Update the tarfile library to the latest secure version.
- Verify tarfile extraction processes adhere to security guidelines.
- Review code for proper filter parameter usage.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-4360.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-4360 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-4360
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-4360 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-4360 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by [email protected]
Jul. 23, 2026
Action Type Old Value New Value Added Reference https://github.com/python/cpython/commit/cf23b9153181062150d061468b6d24af33fe214f Changed Affected [{'repo': 'https://github.com/python/cpython', 'vendor': 'Python Software Foundation', 'modules': ['tarfile'], 'product': 'CPython', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '3.15.0', 'versionType': 'python'}], 'defaultStatus': 'unaffected'}] [{'repo': 'https://github.com/python/cpython', 'vendor': 'Python Software Foundation', 'modules': ['tarfile'], 'product': 'CPython', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '3.15.0b4', 'versionType': 'python'}], 'defaultStatus': 'unaffected'}] -
Initial Analysis by [email protected]
Jul. 09, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Added CPE Configuration OR *cpe:2.3:a:python:python:*:*:*:*:*:*:*:* versions up to (excluding) 3.1.5 Added Reference Type Python Software Foundation: https://github.com/python/cpython/commit/5e0ef3f1afe892e4f64eb83368db57ac4c40cba0 Types: Patch Added Reference Type Python Software Foundation: https://github.com/python/cpython/commit/7b57e8d51446297b8c7c482d224bc5f1938e4301 Types: Patch Added Reference Type Python Software Foundation: https://github.com/python/cpython/commit/7ccdbaba2c54250a70d7f25632152df7655a5e0a Types: Patch Added Reference Type Python Software Foundation: https://github.com/python/cpython/commit/d2b2f5eacab4dd48446b63340613b05dcbbf0b44 Types: Patch Added Reference Type Python Software Foundation: https://github.com/python/cpython/commit/eee3ddf0ca10283cc7fea724aae9cd8665f8d15e Types: Patch Added Reference Type Python Software Foundation: https://github.com/python/cpython/issues/151987 Types: Issue Tracking, Patch Added Reference Type Python Software Foundation: https://github.com/python/cpython/pull/151988 Types: Issue Tracking, Patch Added Reference Type Python Software Foundation: https://mail.python.org/archives/list/[email protected]/thread/TWZW2PC2AZOV6FENIHFSRC63OM7MBGSB/ Types: Issue Tracking, Vendor Advisory -
CVE Modified by [email protected]
Jul. 07, 2026
Action Type Old Value New Value Added Reference https://github.com/python/cpython/commit/d2b2f5eacab4dd48446b63340613b05dcbbf0b44 -
CVE Modified by [email protected]
Jun. 30, 2026
Action Type Old Value New Value Added Reference https://github.com/python/cpython/commit/5e0ef3f1afe892e4f64eb83368db57ac4c40cba0 Added Reference https://github.com/python/cpython/commit/7b57e8d51446297b8c7c482d224bc5f1938e4301 Added Reference https://github.com/python/cpython/commit/7ccdbaba2c54250a70d7f25632152df7655a5e0a Added Reference https://github.com/python/cpython/commit/eee3ddf0ca10283cc7fea724aae9cd8665f8d15e Changed Affected [{'repo': 'https://github.com/python/cpython', 'vendor': 'Python Software Foundation', 'modules': ['tarfile'], 'product': 'CPython', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '3.16.0', 'versionType': 'python'}], 'defaultStatus': 'unaffected'}] [{'repo': 'https://github.com/python/cpython', 'vendor': 'Python Software Foundation', 'modules': ['tarfile'], 'product': 'CPython', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '3.15.0', 'versionType': 'python'}], 'defaultStatus': 'unaffected'}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 30, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-4360', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-06-30T15:28:24.835246Z'} -
New CVE Received by [email protected]
Jun. 30, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://github.com/python/cpython', 'vendor': 'Python Software Foundation', 'modules': ['tarfile'], 'product': 'CPython', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '3.16.0', 'versionType': 'python'}], 'defaultStatus': 'unaffected'}] Added Description In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function. Added CVSS V4.0 AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-281 Added Reference https://github.com/python/cpython/issues/151987 Added Reference https://github.com/python/cpython/pull/151988 Added Reference https://mail.python.org/archives/list/[email protected]/thread/TWZW2PC2AZOV6FENIHFSRC63OM7MBGSB/