CVE-2026-19672

Awaiting Analysis Awaiting Analysis - Queue

Path Traversal in Python's tarfile Module

Publication date: 2026-08-19

Last updated on: 2026-08-27

Assigner: Python Software Foundation

Description

The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given. Only empty directories are created outside the destination. Member contents are still extracted inside it. To return to the destination the member's name must contain the destination directory's own final component, so extraction into a secure randomised directory is not affected. This affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-27

Generated

2026-09-09

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-19672

EUVD

EUVD-2026-62536

Affected Vendors & Products

Vendor	Product	Version / Range
python	cpython	3.10
python	cpython	3.11
python	cpython	3.12
python	cpython	3.13
python	cpython	3.14
python	cpython	3.15

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

CVE-2026-19672 is a vulnerability in Python's tarfile module where tar extraction filters could create empty directories outside the intended destination. This happens when a tar member's name includes paths that leave and return to the destination, like ../evil/../dest/sub/file. The containment check uses resolved paths, but intermediate directories are created from the original name, allowing potential directory traversal on POSIX systems.

Detection Guidance

This vulnerability can be detected by checking Python versions and examining tarfile module behavior. Use 'python3 --version' to verify if your system uses affected Python versions (3.10 to 3.15). Test extraction with malicious tar files containing paths like '../evil/../dest/sub/file' to observe directory creation outside intended destinations.

Impact Analysis

This vulnerability could allow an attacker to create empty directories outside the intended extraction path, potentially leading to unauthorized file system access or disruption. It primarily affects POSIX systems, as Windows automatically collapses path components. Member contents are still extracted inside the destination, limiting direct impact.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by allowing unauthorized directory creation outside intended destinations during tar extraction. This may lead to improper data handling or exposure if exploited, violating data integrity and access control requirements in these regulations.

Mitigation Strategies

Immediately update Python to a patched version (3.10 or later with the fix). If updating isn't possible, avoid using the tarfile module for untrusted archives or implement strict path validation before extraction. Monitor for unusual directory creation during tar operations.

Hi! I’m here to help you understand CVE-2026-19672. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70