CVE-2026-7774: tarfile.data_filter path traversal bypass allows writing outside the extraction directory
Vulnerability summary
CVE-2026-7774 is a medium (CVSS 6.9) vulnerability in python software foundation cpython. EPSS estimates a 0.60% chance of exploitation in the next 30 days, higher than 48.6% of scored vulnerabilities.
Not severe (CVSS 6.9, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 27 · Related 28Timeline
- 04-06-2026PublishedVulnerability first disclosed.
- 13-08-2026Last modifiedVulnerability information updated.
Description
tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · AlpineEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- OSV · DebianEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · WolfiEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- NVDNIST6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.60%
Chance of exploitation in the next 30 days
Percentile
49%
Versus all other CVEs
30-day change
Decrease -0.18 pp
From 0.78% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Suse8 products
- python310-core&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 3.10.20-150400.4.118.1
- python310-core&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 3.10.20-150400.4.118.1
- python310-core&distro=SUSE Linux Enterprise Server 15 SP4-LTSS< 3.10.20-150400.4.118.1
- python310-core&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP4< 3.10.20-150400.4.118.1
- python310&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 3.10.20-150400.4.118.1
Chainguard5 products
- python-3.10< 3.10.21-r0
- python-3.11< 3.11.15-r9
- python-3.12< 3.12.13-r7
- python-3.13< 3.13.14-r0
- python-3.14< 3.14.6-r1
Wolfi5 products
- python-3.10< 3.10.21-r0
- python-3.11< 3.11.15-r9
- python-3.12< 3.12.13-r7
- python-3.13< 3.13.14-r0
- python-3.14< 3.14.6-r1
Ubuntu4 products
- pypy3All versions (No fix recorded)
- python3.12< 3.12.3-1ubuntu0.15
- python3.13All versions (No fix recorded)
- python3.14All versions (No fix recorded) | < 3.14.4-1ubuntu0.1
Debian3 products
- pypy3All versions (No fix recorded) | < 8.0.0+dfsg-1
- python3.13< 3.13.14-1 | < 3.13.5-2+deb13u3
- python3.14< 3.14.6-1
Alpine1 product
- python3< 3.14.7-r0
Python software foundation1 product
- cpython< 3.10.21 | ≥ 3.11.0, < 3.11.16 | ≥ 3.12.0, < 3.12.14 | ≥ 3.13.0, < 3.13.14 | ≥ 3.14.0, < 3.14.6 | ≥ 3.15.0a1, < 3.15.0b2
7 vendors · 27 products
References
23 linksShow all 23 references
- github.com/python/cpythonPACKAGE