CVE-2026-11940 tarfile extraction filter bypass allows escaping the destination directory
Attackers can bypass tarfile extraction filters to create symlinks outside the destination, enabling arbitrary file reads or writes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-11940?
CVE-2026-11940 is a high-severity path traversal vulnerability in CPython, published on 23 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory. This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330.
Which versions are affected by CVE-2026-11940?
3 open source packages ship an affected version, including libpython, python and python-min.
| Package | Affected | Fixed in |
|---|---|---|
libpython Bitnami | All versions | 3.10.21, 3.11.16, 3.12.14, 3.13.15, 3.14.7 |
python Bitnami | All versions | 3.10.21, 3.11.16, 3.12.14, 3.13.15, 3.14.7 |
python-min Bitnami | All versions | 3.10.21, 3.11.16, 3.12.14, 3.13.15, 3.14.7 |
Linux distribution packages (37)
python-unversioned-command AlmaLinux:10 | All versions | 3.12.14-1.el10_2 |
python3 AlmaLinux:10 | All versions | 3.12.14-1.el10_2 |
python3-debug AlmaLinux:10 | All versions | 3.12.14-1.el10_2 |
python3-devel AlmaLinux:10 | All versions | 3.12.14-1.el10_2 |
python3-idle AlmaLinux:10 | All versions | 3.12.14-1.el10_2 |
python3-libs AlmaLinux:10 | All versions | 3.12.14-1.el10_2 |
python3-test AlmaLinux:10 | All versions | 3.12.14-1.el10_2 |
python3-tkinter AlmaLinux:10 | All versions | 3.12.14-1.el10_2 |
python3.14 AlmaLinux:10 | All versions | 3.14.7-2.el10_2 |
python3.14-debug AlmaLinux:10 | All versions | 3.14.7-2.el10_2 |
python3.14-devel AlmaLinux:10 | All versions | 3.14.7-2.el10_2 |
python3.14-freethreading AlmaLinux:10 | All versions | 3.14.7-2.el10_2 |
python3.14-freethreading-debug AlmaLinux:10 | All versions | 3.14.7-2.el10_2 |
python3.14-freethreading-devel AlmaLinux:10 | All versions | 3.14.7-2.el10_2 |
python3.14-freethreading-idle AlmaLinux:10 | All versions | 3.14.7-2.el10_2 |
python3.14-freethreading-libs AlmaLinux:10 | All versions | 3.14.7-2.el10_2 |
python3.14-freethreading-test AlmaLinux:10 | All versions | 3.14.7-2.el10_2 |
python3.14-freethreading-tkinter AlmaLinux:10 | All versions | 3.14.7-2.el10_2 |
python3.14-idle AlmaLinux:10 | All versions | 3.14.7-2.el10_2 |
python3.14-libs AlmaLinux:10 | All versions | 3.14.7-2.el10_2 |
python3.14-test AlmaLinux:10 | All versions | 3.14.7-2.el10_2 |
python3.14-tkinter AlmaLinux:10 | All versions | 3.14.7-2.el10_2 |
platform-python AlmaLinux:8 | All versions | 3.6.8-78.el8_10.alma.1 |
platform-python-debug AlmaLinux:8 | All versions | 3.6.8-78.el8_10.alma.1 |
platform-python-devel AlmaLinux:8 | All versions | 3.6.8-78.el8_10.alma.1 |
python3-idle AlmaLinux:8 | All versions | 3.6.8-78.el8_10.alma.1 |
python3-libs AlmaLinux:8 | All versions | 3.6.8-78.el8_10.alma.1 |
python3-test AlmaLinux:8 | All versions | 3.6.8-78.el8_10.alma.1 |
python3-tkinter AlmaLinux:8 | All versions | 3.6.8-78.el8_10.alma.1 |
python3.12 AlmaLinux:8 | All versions | 3.12.14-1.el8_10 |
python3.12-debug AlmaLinux:8 | All versions | 3.12.14-1.el8_10 |
python3.12-devel AlmaLinux:8 | All versions | 3.12.14-1.el8_10 |
python3.12-idle AlmaLinux:8 | All versions | 3.12.14-1.el8_10 |
python3.12-libs AlmaLinux:8 | All versions | 3.12.14-1.el8_10 |
python3.12-rpm-macros AlmaLinux:8 | All versions | 3.12.14-1.el8_10 |
python3.12-test AlmaLinux:8 | All versions | 3.12.14-1.el8_10 |
python3.12-tkinter AlmaLinux:8 | All versions | 3.12.14-1.el8_10 |
How do I fix CVE-2026-11940?
Upgrade libpython to a fixed version for your release line: 3.10.21, 3.11.16, 3.12.14 or 3.13.15.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-11940 being exploited?
There is no known exploitation of CVE-2026-11940 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-11940, ALSA-2026:54268, ALSA-2026:56219, ALSA-2026:58901, ALSA-2026:58902, ALSA-2026:58928 and 44 more.