Executive Summary

CVE-2026-23949 is a Zip Slip path traversal vulnerability in the jaraco.context Python package, specifically in the tarball() function. The vulnerability occurs because the path filtering function (strip_first_component) improperly handles paths containing '../' sequences, allowing malicious tar archives to extract files outside the intended extraction directory. This means an attacker can craft tar files that, when extracted, place files anywhere on the filesystem, potentially overwriting critical files. The issue also affects nested tarballs, where inner archives can similarly escape the extraction directory. This vulnerability was present in versions 5.2.0 up to but not including 6.1.0, where a patch was introduced to fix the filtering logic and prevent path traversal. [3]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to write arbitrary files anywhere on the filesystem when a vulnerable version of jaraco.context extracts a malicious tar archive. This can lead to unauthorized file creation or overwriting, potentially enabling privilege escalation, supply-chain attacks, or other malicious activities. For example, attackers could overwrite configuration files, place malicious scripts, or modify sensitive data outside the intended extraction directory. The exploitability is considered high for confidentiality impact, though privilege escalation is rated as low exploitability. Overall, it poses a significant security risk when processing untrusted tar files. [3]

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, you can check if your system uses a vulnerable version of the jaraco.context package (>=5.2.0 and <6.1.0). Additionally, you can look for suspicious tar extraction activities that attempt to write files outside the intended extraction directory, especially tarballs containing paths with '../' sequences or absolute paths. Since the vulnerability involves path traversal during tar extraction, monitoring file extraction logs or scanning for unexpected file creations outside extraction directories can help. Specific commands are not provided in the resources, but you might use commands like 'tar -tf <archive>' to list tar contents and manually inspect for traversal paths, or write scripts to parse tarball contents for '../' sequences. Also, checking installed package versions can be done with 'pip show jaraco.context' or equivalent. [3]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading the jaraco.context package to version 6.1.0 or later, where the vulnerability is patched. The patch replaces the unsafe 'strip_first_component' filter with a composed filter that enforces path traversal safety, preventing extraction of files outside the target directory. If upgrading is not immediately possible, avoid processing untrusted tar archives with vulnerable versions of jaraco.context. Additionally, consider applying or backporting the patch that rejects tar members with absolute paths or '../' sequences in their names to prevent path traversal during extraction. [2, 3]

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows attackers to extract files outside the intended directory, potentially leading to unauthorized file creation or modification on the filesystem. This could result in exposure or tampering of sensitive data, which may impact compliance with data protection regulations such as GDPR or HIPAA by violating requirements for data integrity and confidentiality. However, specific compliance impacts are not detailed in the provided resources. [3]

Useful 0 Not Useful 0