CVE-2026-41140: 
Python vulnerability analysis and mitigation

CVE-2026-41140 is a path traversal vulnerability in Poetry, the Python dependency management tool, affecting versions prior to 2.3.4. The flaw exists in the extractall() function (src/poetry/utils/helpers.py, lines 410–426), which extracts sdist tarballs without path traversal protection on Python versions where tarfile.data_filter is unavailable — specifically Python 3.10.0–3.10.12 and 3.11.0–3.11.4. This includes the default Python versions shipped with Debian Bookworm (3.11.2) and Ubuntu 22.04 LTS (3.10.6). The vulnerability was published on April 18, 2026, and carries a CVSS v3.1 score of 8.7 (High) and a CVSS v4.0 score of 0.6 (Low) (Github Advisory, Red Hat Bugzilla).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). In src/poetry/utils/helpers.py, the extractall() function checks for the presence of tarfile.data_filter and, when it is absent or broken (as on the affected Python versions), falls back to calling archive.extractall(dest) with no filter or path validation. This enables three distinct attack vectors: (1) direct path traversal via tar members with ../../ path components writing files outside the extraction directory; (2) symlink traversal where a symlink member points outside dest and subsequent file writes escape the boundary; and (3) hardlink attacks that can read or overwrite files outside dest. The vulnerable code path is triggered from two call sites: src/poetry/installation/chef.py:104 during poetry install/poetry add, and src/poetry/inspection/info.py:322 during dependency resolution (poetry lock/poetry add) when a sdist's PKG-INFO lacks Requires-Dist metadata (Github Advisory, Poetry Security Advisory).

Successful exploitation allows an attacker to write arbitrary files outside the intended extraction directory on the developer's or CI/CD system running Poetry. The traversal can occur during metadata resolution (poetry add --lock), before the build backend is invoked, meaning file writes happen earlier than expected. In practice, the advisory notes the impact is limited because a malicious sdist can already execute arbitrary code via setup.py during the build phase; however, the premature file write during tar extraction is an unintended and uncontrolled behavior that could overwrite sensitive system or configuration files (Github Advisory).

No public exploit code or in-the-wild exploitation has been reported for CVE-2026-41140. The EPSS score is approximately 0.063% (0.09% per GitHub Advisory), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — a developer must add or install a malicious package — and the attack requires specific Python version conditions to be met (Github Advisory).

1. Craft a malicious sdist: Create a Python source distribution (.tar.gz) containing tar members with path traversal sequences (e.g., ../../etc/cron.d/malicious) or symlink members pointing outside the intended extraction directory.
2. Publish or distribute the malicious package: Host the crafted sdist on a package index (e.g., a private PyPI mirror, a typosquatted package on PyPI, or via a dependency confusion attack).
3. Target a vulnerable environment: Identify developer machines or CI/CD pipelines running Poetry < 2.3.4 on Python 3.10.0–3.10.12 or 3.11.0–3.11.4 (e.g., Debian Bookworm or Ubuntu 22.04 LTS defaults).
4. Trigger extraction: Induce the victim to run poetry add <malicious-package> or poetry lock, which calls extractall() during dependency resolution or installation. If the sdist's PKG-INFO lacks Requires-Dist, Poetry will extract the archive for metadata inspection.
5. Achieve arbitrary file write: Because tarfile.data_filter is absent on the target Python version, the unfiltered archive.extractall(dest) call writes tar members to attacker-controlled paths outside the extraction directory, potentially overwriting configuration files, SSH keys, or other sensitive artifacts (Github Advisory, Poetry Security Advisory).

• File System: Unexpected files written outside Poetry's cache or virtual environment directories (e.g., in ~, /etc, /tmp, or other system paths) following a poetry add or poetry lock operation; files with timestamps matching a recent Poetry dependency resolution event in unexpected locations.
• Logs: Poetry output or shell logs showing extraction of sdist archives from unfamiliar or newly added packages; error messages referencing src/poetry/utils/helpers.py or extractall.
• Process: Unusual file creation events (e.g., via inotifywait or auditd) triggered by the Poetry process (python, poetry) writing to directories outside the project or virtual environment scope during dependency resolution.

Upgrade Poetry to version 2.3.4 or newer, which adds path validation in the extractall() function to ensure all tar members resolve to paths inside the target directory, covering direct traversal, symlink traversal, and hardlink attacks. As a secondary mitigation, upgrading Python to 3.10.13+, 3.11.5+, or any 3.12+ version ensures tarfile.data_filter is available and functional, preventing the vulnerable code path from being reached. Users who cannot immediately upgrade should avoid adding or installing packages from untrusted or unverified sources (Github Advisory, Red Hat Bugzilla).

The vulnerability was reported by researcher kodareef5 and reviewed for remediation by radoering (a Poetry maintainer), who published the security advisory on April 18, 2026. Red Hat triaged the issue as high severity in their Bugzilla tracker. No significant broader media coverage or notable community debate has been identified beyond the standard advisory channels (Github Advisory, Red Hat Bugzilla).