CVE-2026-11940

Full vulnerability record from the local CVENow database.

Description

tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory. This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330.

Severity

HIGH

CVSS score

7.8 (v4.0)

Vulnerability status

Awaiting Analysis

Source identifier

[email protected]

Published

2026-06-23 17:16:40.847000

Last modified

2026-10-26 11:10:00.157000

View original CVE JSON

{
  "id": "CVE-2026-11940",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-23T17:16:40.847",
  "lastModified": "2026-10-26T11:10:00.157",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "tarfile.extractall() with the 'data' or 'tar'\n filter could be bypassed by a crafted archive where a hardlink \nreferences a symlink stored at a deeper name than the hardlink itself.  \nThe extraction fallback validated the symlink at it's archived location \nbut recreated it at the hardlink's shallower\npath, letting a relative\n target the filter judged contained escape the destination directory.  \nThis allowed a malicious tar archive to create a symlink pointing \noutside the destination, enabling out-of-destination file reads or \nwrites. This was an incomplete fix of CVE-2025-4330."
    },
    {
      "lang": "es",
      "value": "“tarfile.extractall()” con el filtro ’data’ o ’tar’ podría ser eludido por un archivo especialmente diseñado donde un enlace duro hace referencia a un enlace simbólico almacenado en una ruta más profunda que el propio enlace duro. El mecanismo de reserva de extracción validó el enlace simbólico en su ubicación archivada pero lo recreó en la ruta menos profunda del enlace duro, permitiendo que un objetivo relativo que el filtro juzgó contenido escapara del directorio de destino. Esto permitió que un archivo tar malicioso creara un enlace simbólico apuntando fuera del destino, habilitando lecturas o escrituras de archivos fuera del destino. Esta fue una corrección incompleta de CVE-2025-4330."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Python Software Foundation",
          "product": "CPython",
          "defaultStatus": "unaffected",
          "repo": "https://github.com/python/cpython",
          "versions": [
            {
              "version": "0",
              "lessThan": "3.10.21",
              "versionType": "python",
              "status": "affected"
            },
            {
              "version": "3.11.0",
              "lessThan": "3.11.16",
              "versionType": "python",
              "status": "affected"
            },
            {
              "version": "3.12.0",
              "lessThan": "3.12.14",
              "versionType": "python",
              "status": "affected"
            },
            {
              "version": "3.13.0",
              "lessThan": "3.13.15",
              "versionType": "python",
              "status": "affected"
            },
            {
              "version": "3.14.0",
              "lessThan": "3.14.7",
              "versionType": "python",
              "status": "affected"
            },
            {
              "version": "3.15.0a1",
              "lessThan": "3.15.0b4",
              "versionType": "python",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "HIGH",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-23T17:57:25.652265Z",
          "id": "CVE-2026-11940",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-59"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/python/cpython/commit/0f852b3f07dd8e71e40326a51c02afbf16a42cc5",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/python/cpython/commit/27dd970bf6b17ebca7c8ed486a40ab043ed7af8f",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/python/cpython/commit/672825e2f36a57e173959b0d9d409d4560dab8df",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/python/cpython/commit/771d12dda5140313db0ac550292987975651bbde",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/python/cpython/commit/79c06bd5c6afa3c440d50faf7ee1b147c8832b4c",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/python/cpython/commit/be13e86f6b9788a6f4d0419dffef72cbae5865c9",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/python/cpython/commit/e5fdbd8d5aa923bd9111b112ea73bd6ec7c47877",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/python/cpython/issues/151558",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/python/cpython/pull/151559",
      "source": "[email protected]"
    },
    {
      "url": "https://mail.python.org/archives/list/[email protected]/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/",
      "source": "[email protected]"
    }
  ]
}