Executive Summary

CVE-2026-11940 is a security vulnerability in Python's tarfile module, specifically in the extractall() function when used with the 'data' or 'tar' filter.

The vulnerability arises because a crafted tar archive can contain a hardlink that references a symlink stored at a deeper path than the hardlink itself.

During extraction, the process validates the symlink at its archived location but recreates it at the hardlink's shallower path. This allows a relative target to bypass the filter's directory containment checks and escape the intended extraction directory.

As a result, a malicious tar archive can create a symlink pointing outside the destination directory, enabling unauthorized file reads or writes outside the extraction target.

This vulnerability is an incomplete fix of a previous issue identified as CVE-2025-4330.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to craft a malicious tar archive that, when extracted, creates symlinks pointing outside the intended extraction directory.

Such behavior can lead to unauthorized file reads or writes outside the destination directory, potentially overwriting or exposing sensitive files on the system.

Because the extraction process bypasses intended directory containment, it can be exploited to compromise system integrity or confidentiality.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update your Python environment to a version where the fix has been applied. The patch addressing CVE-2026-11940 was merged on June 23, 2026, and backports are available for Python versions 3.10 through 3.15.

Avoid extracting tar archives using tarfile.extractall() with the 'data' or 'tar' filter from untrusted sources until the fix is applied, as the vulnerability allows crafted archives to create symlinks pointing outside the extraction directory.

Useful 0 Not Useful 0

Compliance Impact

CVE-2026-11940 allows a malicious tar archive to create symlinks pointing outside the intended extraction directory, potentially enabling unauthorized file reads or writes outside the destination directory.

Such unauthorized file access or modification could lead to data breaches or exposure of sensitive information, which may impact compliance with data protection regulations like GDPR or HIPAA that require safeguarding personal and sensitive data.

Therefore, if an application using the vulnerable Python tarfile module extracts untrusted archives, it could inadvertently violate these standards by allowing attackers to access or alter protected data outside the intended scope.

Useful 0 Not Useful 0

Detection Guidance

Detection of CVE-2026-11940 involves identifying attempts to extract malicious tar archives that exploit the symlink escape vulnerability in Python's tarfile module. Specifically, crafted tar files that create hardlinks referencing symlinks pointing outside the intended extraction directory are indicators of this vulnerability being exploited.

A practical approach to detection is to use the test case added in the Python source code to detect this vulnerability: `test_sneaky_hardlink_fallback_deep`. This test simulates the attack scenario and can be used as a reference to create detection scripts or tools.

While no direct network commands are provided in the resources, monitoring for extraction of tar archives with suspicious hardlink and symlink combinations is recommended. On systems, you can manually inspect tar archives before extraction using commands like:

• tar -tvf suspicious_archive.tar
• Look for entries that are hardlinks (type 'h') pointing to symlinks (type 'l') at deeper paths.

Additionally, you can use Python scripts to attempt extraction with the vulnerable `tarfile.extractall()` method using the 'data' or 'tar' filter and observe if the extraction escapes the intended directory, indicating vulnerability.

For automated detection, reviewing logs or alerts for unexpected file writes outside extraction directories during tar extraction processes may help identify exploitation attempts.

Useful 0 Not Useful 0