CVE-2026-11940
Vulnerability Summary
Timeline
Description
tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory. This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330.
CVSS Metrics
- v4.0•HIGH•Score: 7.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
- v4.0•HIGH•Score: 7.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- v3.1•HIGH•Score: 7.3CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
EPSS Trends
Current EPSS score: 0.75%• Percentile: 53%
Techniques & Countermeasures
- CWE-22•Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
- CWE-59•Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Affected Systems
- alpine•python3
< 3.12.14-r0 | < 3.12.14-r0 | < 3.12.14-r0 | < 3.14.7-r0
- chainguard•python-3.10
< 3.10.20-r10
- chainguard•python-3.11
< 3.11.15-r8
- chainguard•python-3.12
< 3.12.13-r10
- chainguard•python-3.13
< 3.13.14-r2
- chainguard•python-3.14
< 3.14.6-r3
- wolfi•python-3.10
< 3.10.20-r10
- wolfi•python-3.11
< 3.11.15-r8
- wolfi•python-3.12
< 3.12.13-r10
- wolfi•python-3.13
< 3.13.14-r2
- wolfi•python-3.14
< 3.14.6-r3
- debian•pypy3
all | all
- debian•python2.7
all
- debian•python3.11
all
- debian•python3.13
all | all | < 3.13.5-2+deb13u5 | < 3.13.15-1
- debian•python3.14
all | < 3.14.7-1
- debian•python3.9
all
- ubuntu•pypy3
all | all | all | all | all
- ubuntu•python2.7
all
- ubuntu•python3.10
all
- ubuntu•python3.11
all | all
- ubuntu•python3.12
all
- ubuntu•python3.13
all
- ubuntu•python3.14
all | all
- ubuntu•python3.4
all
- ubuntu•python3.5
all
- ubuntu•python3.6
all
- ubuntu•python3.7
all
- ubuntu•python3.8
all
- ubuntu•python3.9
all
- python software foundation•cpython
< 3.16.0 | < 3.15.0 | < 3.13.15 | < 3.10.21 | ≥ 3.11.0, < 3.11.16 | ≥ 3.12.0, < 3.12.14 | ≥ 3.13.0, < 3.13.15 | ≥ 3.14.0, < 3.14.7 | ≥ 3.15.0a1, < 3.15.0b4
- opensuse•python314&distro=openSUSE Tumbleweed
< 3.14.6-2.1
- redhat•platform-python
< 0:3.6.8-78.el8_10 | < 0:3.6.8-78.el8_10 | < 0:3.6.8-51.el8_8.17 | < 0:3.6.8-51.el8_8.17 | < 0:3.6.8-47.el8_6.15 | < 0:3.6.8-47.el8_6.15
- redhat•platform-python-debug
< 0:3.6.8-78.el8_10 | < 0:3.6.8-51.el8_8.17 | < 0:3.6.8-47.el8_6.15
- redhat•platform-python-devel
< 0:3.6.8-78.el8_10 | < 0:3.6.8-51.el8_8.17 | < 0:3.6.8-47.el8_6.15
- redhat•python-unversioned-command
< 0:3.9.25-7.el9_8.3 | < 0:3.12.14-1.el10_2 | < 0:3.12.9-2.el10_0.11
- redhat•python3
< 0:3.9.25-7.el9_8.3 | < 0:3.9.25-7.el9_8.3 | < 0:3.6.8-78.el8_10 | < 0:3.12.14-1.el10_2 | < 0:3.12.9-2.el10_0.11 | < 0:3.6.8-51.el8_8.17 | < 0:3.6.8-47.el8_6.15
- redhat•python3-debug
< 0:3.9.25-7.el9_8.3 | < 0:3.12.14-1.el10_2 | < 0:3.12.9-2.el10_0.11
- redhat•python3-debuginfo
< 0:3.6.8-78.el8_10 | < 0:3.6.8-78.el8_10 | < 0:3.6.8-51.el8_8.17 | < 0:3.6.8-51.el8_8.17 | < 0:3.6.8-47.el8_6.15 | < 0:3.6.8-47.el8_6.15
- redhat•python3-debugsource
< 0:3.6.8-78.el8_10 | < 0:3.6.8-78.el8_10 | < 0:3.6.8-51.el8_8.17 | < 0:3.6.8-51.el8_8.17 | < 0:3.6.8-47.el8_6.15 | < 0:3.6.8-47.el8_6.15
- redhat•python3-devel
< 0:3.9.25-7.el9_8.3 | < 0:3.12.14-1.el10_2 | < 0:3.12.9-2.el10_0.11
- redhat•python3-idle
< 0:3.9.25-7.el9_8.3 | < 0:3.6.8-78.el8_10 | < 0:3.12.14-1.el10_2 | < 0:3.12.9-2.el10_0.11 | < 0:3.6.8-51.el8_8.17 | < 0:3.6.8-47.el8_6.15
- redhat•python3-libs
< 0:3.9.25-7.el9_8.3 | < 0:3.6.8-78.el8_10 | < 0:3.12.14-1.el10_2 | < 0:3.12.9-2.el10_0.11 | < 0:3.6.8-51.el8_8.17 | < 0:3.6.8-47.el8_6.15
- redhat•python3-test
< 0:3.9.25-7.el9_8.3 | < 0:3.6.8-78.el8_10 | < 0:3.6.8-78.el8_10 | < 0:3.12.14-1.el10_2 | < 0:3.12.9-2.el10_0.11 | < 0:3.6.8-51.el8_8.17 | < 0:3.6.8-51.el8_8.17 | < 0:3.6.8-47.el8_6.15 | < 0:3.6.8-47.el8_6.15
- redhat•python3-tkinter
< 0:3.9.25-7.el9_8.3 | < 0:3.9.25-7.el9_8.3 | < 0:3.6.8-78.el8_10 | < 0:3.12.14-1.el10_2 | < 0:3.12.9-2.el10_0.11 | < 0:3.6.8-51.el8_8.17 | < 0:3.6.8-47.el8_6.15
- redhat•python3.12
< 0:3.12.14-1.el10_2 | < 0:3.12.14-1.el8_10 | < 0:3.12.14-1.el8_10 | < 0:3.12.14-1.el9_8 | < 0:3.12.14-1.el9_8 | < 0:3.12.1-4.el9_4.15 | < 0:3.12.9-2.el10_0.11 | < 0:3.12.9-1.el9_6.10 | < 0:3.12.9-1.el9_6.10
- redhat•python3.12-debug
< 0:3.12.14-1.el8_10 | < 0:3.12.14-1.el9_8 | < 0:3.12.9-1.el9_6.10
- redhat•python3.12-debuginfo
< 0:3.12.14-1.el10_2 | < 0:3.12.14-1.el8_10 | < 0:3.12.14-1.el8_10 | < 0:3.12.14-1.el9_8 | < 0:3.12.14-1.el9_8 | < 0:3.12.1-4.el9_4.15 | < 0:3.12.9-2.el10_0.11 | < 0:3.12.9-1.el9_6.10 | < 0:3.12.9-1.el9_6.10
- redhat•python3.12-debugsource
< 0:3.12.14-1.el10_2 | < 0:3.12.14-1.el8_10 | < 0:3.12.14-1.el8_10 | < 0:3.12.14-1.el9_8 | < 0:3.12.14-1.el9_8 | < 0:3.12.1-4.el9_4.15 | < 0:3.12.9-2.el10_0.11 | < 0:3.12.9-1.el9_6.10 | < 0:3.12.9-1.el9_6.10
- redhat•python3.12-devel
< 0:3.12.14-1.el8_10 | < 0:3.12.14-1.el9_8 | < 0:3.12.1-4.el9_4.15 | < 0:3.12.9-1.el9_6.10
Showing first 50 affected entries in server-rendered view.
References (45)
- https://github.com/python/cpython/pull/151559
- https://mail.python.org/archives/list/security-announce@python.org/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/
- https://github.com/python/cpython/issues/151558
- https://github.com/python/cpython/commit/27dd970bf6b17ebca7c8ed486a40ab043ed7af8f
- https://github.com/python/cpython/commit/672825e2f36a57e173959b0d9d409d4560dab8df
- https://github.com/python/cpython/commit/771d12dda5140313db0ac550292987975651bbde
- https://github.com/python/cpython/commit/79c06bd5c6afa3c440d50faf7ee1b147c8832b4c
- https://github.com/python/cpython/commit/be13e86f6b9788a6f4d0419dffef72cbae5865c9
- https://github.com/python/cpython/commit/e5fdbd8d5aa923bd9111b112ea73bd6ec7c47877
- https://github.com/python/cpython/commit/0f852b3f07dd8e71e40326a51c02afbf16a42cc5
- https://access.redhat.com/errata/RHSA-2026:54268
- https://access.redhat.com/security/updates/classification/#important
- https://bugzilla.redhat.com/show_bug.cgi?id=2491848
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54268.json
- https://access.redhat.com/security/cve/CVE-2026-11940
- https://www.cve.org/CVERecord?id=CVE-2026-11940
- https://nvd.nist.gov/vuln/detail/CVE-2026-11940
- https://ubuntu.com/security/CVE-2026-11940
- https://security-tracker.debian.org/tracker/CVE-2026-11940
- https://www.suse.com/security/cve/CVE-2026-11940
- https://security.alpinelinux.org/vuln/CVE-2026-11940
- https://access.redhat.com/errata/RHSA-2026:56219
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_56219.json
- https://access.redhat.com/errata/RHSA-2026:58902
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_58902.json
- https://access.redhat.com/errata/RHSA-2026:58971
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_58971.json
- https://access.redhat.com/errata/RHSA-2026:59009
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59009.json
- https://access.redhat.com/errata/RHSA-2026:58901
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_58901.json
- https://access.redhat.com/errata/RHSA-2026:58928
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_58928.json
- https://access.redhat.com/errata/RHSA-2026:62809
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_62809.json
- https://access.redhat.com/errata/RHSA-2026:63024
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_63024.json
- https://access.redhat.com/errata/RHSA-2026:63117
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_63117.json
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/11xxx/CVE-2026-11940.json
- https://github.com/python/cpython
- https://access.redhat.com/errata/RHSA-2026:64806
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_64806.json
- https://access.redhat.com/errata/RHSA-2026:64816
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_64816.json