CVE-2026-114583: tar filter allows writing outside destination via empty-named symlink

Vulnerability summary

CVE-2026-114583 is a medium (CVSS 6.9) vulnerability in python software foundation cpython. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 17.9% of scored vulnerabilities.

Timeline

1. 22-10-2026
   PublishedVulnerability first disclosed.
2. 02-11-2026
   Last modifiedVulnerability information updated.

Description

tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter="tar" to write files outside the destination directory, subject to the permissions of the extracting process. This is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter.

• CWE-22Improper Limitation of a Pathname to a Restricted DirectoryThe product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.