Medium severity · published Sep 11, 2026
CVE-2026-87910
tarfile hardlink fallback ignores custom extraction filter rejection via None
5.7
CVSS
0.6%
EPSS
No
On KEV
Description
When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CP
CPython · Python Software Foundation
before 3.10.22; 3.11.0 before 3.11.17; 3.12.0 before 3.12.15; 3.13.0 before 3.13.16; 3.14.0 before 3.14.9; 3.15.0a1 before 3.15.0rc3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-87910
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-87910
vendor-advisory
https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/
patch
https://github.com/python/cpython/pull/157266
issue-tracking
https://github.com/python/cpython/issues/157265
patch
https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b
patch
https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2
patch
https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955
More from CPython
9.4
CVE-2026-115557
Distrust compromised intermediate certificates in ssl module
9.4
CVE-2025-4517
Arbitrary writes via tarfile realpath overflow
9.2
CVE-2026-19445
Use-after-free of a server-side SSLContext when sni_callback switches contexts
8.8
CVE-2026-3298
Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes
8.7
CVE-2024-8088
Infinite loop when iterating over zip archive entry names from zipfile.Path