CPython <3.13 Tarfile Hard-Link to Symlink Vulnerability
CVE-2026-82049 Published on September 14, 2026
tarfile extraction filters allow file modification and content disclosure via hard link to symlink
In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.
Vulnerability Analysis
CVE-2026-82049 can be exploited with local system access. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is an insecure temporary file Vulnerability?
The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CVE-2026-82049 has been classified to as an insecure temporary file vulnerability or weakness.
Products Associated with CVE-2026-82049
Want to know whenever a new CVE is published for Cpython? stack.watch will email you.
Affected Versions
Python Software Foundation CPython:- Before 3.10.22 is affected.
- Version 3.11.0 and below 3.11.17 is affected.
- Version 3.12.0 and below 3.12.15 is affected.
- Version 3.13.0 and below 3.13.16 is affected.
- Version 3.14.0a1 and below 3.14.0b1 is affected.