Python
Python Tarfile: vulnerabilidades y CVE
Python Tarfile tiene 8 vulnerabilidades publicadas, 5 de ellas en los últimos 12 meses. 1 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE8
Últimos 12 meses5
Críticas1
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-87910 | Media (5.7) | 0.54% | — | 11 sept 2026 | When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with… |
| CVE-2026-19672 | Media (6.3) | 0.52% | — | 19 ago 2026 | The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check… |
| CVE-2026-11972 | Alta (8.2) | 0.71% | — | 23 jun 2026 | When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer. |
| CVE-2026-11940 | Alta (7.8) | 0.75% | — | 23 jun 2026 | tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the… |
| CVE-2026-7774 | Media (6.9) | 0.78% | — | 4 jun 2026 | tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a… |
| CVE-2025-4517 | Crítica (9.4) | 1.4% | — | 3 jun 2025 | Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data". You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using… |
| CVE-2025-4435 | Alta (7.5) | 0.59% | — | 3 jun 2025 | When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any filtered members would be skipped and not extracted. However the actual behavior of TarFile.errorlevel = 0 in affected… |
| CVE-2025-4330 | Alta (7.5) | 0.94% | — | 3 jun 2025 | Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are affected by this vulnerability if using the tarfile… |