CVE-2026-7774 tarfile.data_filter path traversal bypass allows writing outside the extraction directory
A malicious tar archive can bypass path traversal protections in Python's tarfile module to write files outside the intended extraction directory.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-7774?
CVE-2026-7774 is a medium-severity path traversal vulnerability in CPython, published on 4 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process.
Weakness: CWE-22
Which versions are affected by CVE-2026-7774?
3 open source packages ship an affected version, including libpython, python and python-min.
| Package | Affected | Fixed in |
|---|---|---|
libpython Bitnami | All versions | 3.10.21, 3.11.16, 3.12.14, 3.13.14, 3.14.6 |
python Bitnami | All versions | 3.10.21, 3.11.16, 3.12.14, 3.13.14, 3.14.6 |
python-min Bitnami | All versions | 3.10.21, 3.11.16, 3.12.14, 3.13.14, 3.14.6 |
Linux distribution packages (8)
python310 SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 3.10.20-150400.4.118.1 |
python310-core SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 3.10.20-150400.4.118.1 |
python310 SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 3.10.20-150400.4.118.1 |
python310-core SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 3.10.20-150400.4.118.1 |
python310 SUSE:Linux Enterprise Server 15 SP4-LTSS | All versions | 3.10.20-150400.4.118.1 |
python310-core SUSE:Linux Enterprise Server 15 SP4-LTSS | All versions | 3.10.20-150400.4.118.1 |
python310 SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | All versions | 3.10.20-150400.4.118.1 |
python310-core SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | All versions | 3.10.20-150400.4.118.1 |
How do I fix CVE-2026-7774?
Upgrade libpython to a fixed version for your release line: 3.10.21, 3.11.16, 3.12.14 or 3.13.14.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-7774 being exploited?
There is no known exploitation of CVE-2026-7774 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-7774, AZL-89472, BELL-CVE-2026-7774, BIT-libpython-2026-7774, BIT-python-2026-7774, BIT-python-min-2026-7774 and 12 more.