CVE-2026-19672
Received Received - Intake

Path Traversal in Python's tarfile Module

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Python Software Foundation

Description
The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given. Only empty directories are created outside the destination. Member contents are still extracted inside it. To return to the destination the member's name must contain the destination directory's own final component, so extraction into a secure randomised directory is not affected. This affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-19672
EUVD
EUVD-2026-62536

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
python cpython 3.10
python cpython 3.11
python cpython 3.12
python cpython 3.13
python cpython 3.14
python cpython 3.15

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-19672 is a vulnerability in Python's tarfile module where tar extraction filters could create empty directories outside the intended destination. This happens when a tar member's name includes paths that leave and return to the destination, like ../evil/../dest/sub/file. The containment check uses resolved paths, but intermediate directories are created from the original name, allowing potential directory traversal on POSIX systems.

Detection Guidance

This vulnerability can be detected by checking Python versions and examining tarfile module behavior. Use 'python3 --version' to verify if your system uses affected Python versions (3.10 to 3.15). Test extraction with malicious tar files containing paths like '../evil/../dest/sub/file' to observe directory creation outside intended destinations.

Impact Analysis

This vulnerability could allow an attacker to create empty directories outside the intended extraction path, potentially leading to unauthorized file system access or disruption. It primarily affects POSIX systems, as Windows automatically collapses path components. Member contents are still extracted inside the destination, limiting direct impact.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by allowing unauthorized directory creation outside intended destinations during tar extraction. This may lead to improper data handling or exposure if exploited, violating data integrity and access control requirements in these regulations.

Mitigation Strategies

Immediately update Python to a patched version (3.10 or later with the fix). If updating isn't possible, avoid using the tarfile module for untrusted archives or implement strict path validation before extraction. Monitor for unusual directory creation during tar operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19672. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart