CVE-2026-87910

Awaiting Analysis Awaiting Analysis - Queue

Path Traversal in Python tarfile Extraction

Publication date: 2026-09-11

Last updated on: 2026-10-01

Assigner: Python Software Foundation

Description

When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-10-01

Generated

2026-10-02

AI Q&A

2026-09-11

EPSS Evaluated

2026-09-29

NVD

CVE-2026-87910

EUVD

EUVD-2026-76162

Affected Vendors & Products

Vendor	Product	Version / Range
python	cpython	3.10
python	cpython	3.11
python	cpython	3.12
python	cpython	3.13
python	cpython	3.14
python	cpython	3.15
python	cpython	3.16

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

Executive Summary

CVE-2026-87910 is a vulnerability in Python's tarfile module. When extracting a hardlink from a tar archive on a system that doesn't support hardlinks, the module falls back to extracting a regular file. During this process, a custom filter function is called twice: once for the extracted member and once for the link location. However, the return value of one call is ignored, which could allow unintended file extraction if the filter returns None.

Detection Guidance

This vulnerability is specific to Python's tarfile module and cannot be directly detected via network or system commands. Instead, check if your Python version is affected by running: python3 --version. If your version is below the patched release (e.g., 3.10 to 3.15), the vulnerability may exist.

Impact Analysis

This vulnerability could allow an attacker to bypass security filters and extract unintended files from a tar archive. This might lead to unauthorized file access, data leakage, or other malicious activities depending on the extracted files.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by allowing unintended file extraction from tar archives. If an attacker exploits this flaw to extract unauthorized files, it may lead to unauthorized access to sensitive data, violating confidentiality requirements under these regulations.

Mitigation Strategies

Update Python to a patched version (3.10 to 3.16) where the tarfile module fix has been applied. Check the linked CVE record or GitHub pull requests for specific patched versions.

Hi! I’m here to help you understand CVE-2026-87910. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70