CVE-2026-4360

Aliases:RHSA-2026:47892RHSA-2026:47896RHSA-2026:47915RHSA-2026:47926RHSA-2026:47930UBUNTU-CVE-2026-4360DEBIAN-CVE-2026-4360ALPINE-CVE-2026-4360CGA-3j98-689h-m79jCGA-8qxw-mxj5-qqfvCGA-9646-w997-fx2cCGA-f8hr-j6hp-3g5wCGA-fj7c-qx2m-pqr4CGA-hcg2-3rm7-mmvfCGA-jr9q-86mm-jvfcCGA-r9j7-vg7g-m59vCGA-v6c3-6q52-4qfjCGA-x27p-jmrc-jcmr
Advisory lineage Upstream: 0 Downstream: 24
Modified
Published: 30 Jun 2026, 14:45
Last modified:13 Aug 2026, 00:27

Vulnerability Summary

Overall Risk (default)
low
21/100
CVSS Score
5.3 MEDIUM
v3.1 (nvd)
EPSS Score
0.28% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

30 Jun 2026, 14:45
Published
Vulnerability first disclosed
13 Aug 2026, 00:27
Last Modified
Vulnerability information updated

Description

In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.

CVSS Metrics

  • v4.0•LOW•Score: 2CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
  • v4.0•LOW•Score: 2CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
  • v3.1•MEDIUM•Score: 5CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

EPSS Trends

Current EPSS score: 0.28%• Percentile: 20%

Techniques & Countermeasures

  • CWE-281•Improper Preservation of Permissions

    The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

Affected Systems

  • alpine•python3

    < 3.12.14-r0 | < 3.12.14-r0 | < 3.12.14-r0 | < 3.14.7-r0

  • chainguard•python-3.10

    < 3.10.20-r10

  • chainguard•python-3.11

    < 3.11.15-r8

  • chainguard•python-3.12

    < 3.12.13-r10

  • chainguard•python-3.13

    < 3.13.14-r2

  • chainguard•python-3.14

    < 3.14.6-r3

  • wolfi•python-3.10

    < 3.10.20-r10

  • wolfi•python-3.11

    < 3.11.15-r8

  • wolfi•python-3.12

    < 3.12.13-r10

  • wolfi•python-3.13

    < 3.13.14-r2

  • wolfi•python-3.14

    < 3.14.6-r3

  • debian•pypy3

    all | all

  • debian•python3.13

    all | all | < 3.13.5-2+deb13u5 | < 3.13.15-1

  • debian•python3.14

    all | < 3.14.7-1

  • ubuntu•python2.7

    all | < 2.7.6-8ubuntu0.6+esm30 | < 2.7.12-1ubuntu0~16.04.18+esm22 | < 2.7.17-1~18.04ubuntu1.13+esm15 | < 2.7.18-13ubuntu1.5+esm9

  • ubuntu•python3.10

    all | < 3.10.12-1~22.04.18

  • ubuntu•python3.11

    all | all | < 3.11.0~rc1-1~22.04.1+esm2

  • ubuntu•python3.12

    all | < 3.12.3-1ubuntu0.17

  • ubuntu•python3.13

    all

  • ubuntu•python3.14

    all | all | < 3.14.4-1ubuntu0.2

  • ubuntu•python3.4

    all | < 3.4.3-1ubuntu1~14.04.7+esm21

  • ubuntu•python3.5

    all | < 3.5.2-2ubuntu0~16.04.4~14.04.1+esm11 | < 3.5.2-2ubuntu0~16.04.13+esm25

  • ubuntu•python3.6

    all | < 3.6.9-1~18.04ubuntu1.13+esm10

  • ubuntu•python3.7

    all | < 3.7.5-2ubuntu1~18.04.2+esm11

  • ubuntu•python3.8

    all | < 3.8.0-3ubuntu1~18.04.2+esm11 | < 3.8.10-0ubuntu1~20.04.18+esm7

  • ubuntu•python3.9

    all | < 3.9.5-3ubuntu0~20.04.1+esm11

  • python software foundation•cpython

    < 3.15.0 | < 3.13.15 | < 3.10.21 | ≥ 3.11.0, < 3.11.16 | ≥ 3.12.0, < 3.12.14 | ≥ 3.13.0, < 3.13.15 | ≥ 3.14.0, < 3.14.7 | ≥ 3.15.0a1, < 3.15.0b4

  • python•python

    < 3.1.5

  • redhat•python-unversioned-command

    < 0:3.14.6-2.1.hum1

  • redhat•python3

    < 0:3.14.6-2.1.hum1

  • redhat•python3.10

    < 0:3.10.20-3.1.hum1

  • redhat•python3.11

    < 0:3.11.15-5.4.hum1

  • redhat•python3.12

    < 0:3.12.13-3.7.hum1

  • redhat•python3.13

    < 0:3.13.14-1.6.hum1

  • redhat•python3.14

    < 0:3.14.6-2.1.hum1

References (32)