CVE-2026-4360 | In the Tarfile.extract() function, the filter parameter is n… | CVSS 2.0 LOW

Description

In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.

Metadata

CVE ID: CVE-2026-4360
State: PUBLISHED
Assigner: PSF
Reserved: 2026-03-17 19:25 UTC
Published: 2026-06-30 14:45 UTC
Last updated: 2026-06-30 15:28 UTC
Primary CWE: CWE-281
CWE-281
Vendor / Product: Python Software Foundation / CPython
Sources: cve.org · NVD

Severity & Metrics

2.0 LOW CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
Python Software Foundation	CPython	—	0 < 3.15.0

Weakness (CWE)

CWE	Source	Description
CWE-281	cna	CWE-281

CVSS scores (1)

Score	Severity	Version	Source	Vector
2.0	LOW	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References (7)