CVE-2026-82049: 
Python Interpreter vulnerability analysis and mitigation

CVE-2026-82049 is a tarfile extraction filter bypass vulnerability in CPython's tarfile module affecting CPython 3.13 and all earlier versions (specifically all versions before 3.14.0b1). The flaw allows crafted tar archives containing a hard link to a symbolic link to bypass the data and tar extraction filters, potentially modifying file permissions or modification times of files outside the intended extraction directory, or exposing their contents within the extracted tree. The vulnerability was reported by Stan Ulbrych on September 8, 2026, and publicly disclosed on September 14, 2026. It carries a CVSS v4.0 base score of 8.4 (High) (oss-security, CPython Issue).

The root cause is classified as CWE-59 (Improper Link Resolution Before File Access / 'Link Following'). When the tarfile module's data or tar extraction filters process a hard link entry pointing to a symbolic link, the underlying os.link() call on Linux does not follow symlinks by default (it duplicates the symlink itself rather than the target file). This means a crafted archive can place a hard link to a symlink at a shallower path, causing the symlink's relative target to resolve outside the extraction directory. The fix, applied in Lib/tarfile.py, replaces os.link(tarinfo._link_target, targetpath) with os.link(os.path.realpath(tarinfo._link_target), targetpath) to resolve the real target before creating the hard link, preventing symlink escape (CPython Issue, CPython PR #157191, CPython Commit b8f23e3). The vulnerability was incidentally fixed for CPython 3.14+ by a separate change to os.link() (commit 5a57248) that made it use linkat() with AT_SYMLINK_FOLLOW on Linux (CPython Commit 5a57248).

Successful exploitation allows an attacker who can supply a crafted tar archive to a victim application using CPython's tarfile module with the data or tar filter to achieve two outcomes: (1) modify the permissions or modification time of arbitrary files outside the intended extraction directory that the extracting user has access to, and (2) expose the contents of those external files within the extracted archive tree, enabling file content disclosure. The attack requires passive user interaction (a user or automated process must extract the malicious archive), and the scope is limited to files accessible by the extracting process's user account. There is no availability impact, but both confidentiality and integrity of files outside the extraction sandbox are at risk (oss-security, CPython Issue).

As of the disclosure date (September 14, 2026), there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack vector is local (the attacker must be able to supply a crafted archive to a victim), requires no privileges, but does require passive user interaction (extraction of the archive). The SSVC assessment indicates exploitation is not automatable (Feedly).

1. Craft a malicious tar archive: Create a tar archive with the following structure:

   • A regular file at a/escape (decoy content)
   • A symlink at a/b/s pointing to ../escape (which resolves to a/escape inside the tree, but can be made to point outside)
   • A hard link entry s pointing to a/b/s (the symlink)

2. Exploit symlink relocation: When the tarfile module processes the hard link entry s -> a/b/s, on Linux, os.link() without AT_SYMLINK_FOLLOW duplicates the symlink itself rather than its target. This places a copy of the symlink at a shallower path (s), where its relative target (../escape) now resolves to a path outside the extraction directory.

3. Trigger extraction with a vulnerable filter: Deliver the archive to a target application that extracts it using tarfile.extract() or tarfile.extractall() with filter='data' or filter='tar' on CPython 3.13 or earlier.

4. Achieve file content disclosure: After extraction, the path <destdir>/s resolves to a file outside the extraction directory. Reading <destdir>/s returns the content of the external file.

5. Achieve permission/timestamp modification: The extraction process applies chmod/utime operations to the hard link target, which now resolves to the external file, modifying its metadata outside the intended sandbox (CPython Issue, CPython Commit b8f23e3).

• File System: Presence of a hard link or symlink within an extraction directory that resolves to a path outside the destination directory; unexpected changes to file permissions or modification timestamps on files outside the extraction directory following a tar extraction operation.
• Logs: Application logs showing tarfile extraction of archives from untrusted or external sources; Python tracebacks or warnings related to tarfile filter operations (if logging is enabled).
• Process: Python processes invoking tarfile.extractall() or tarfile.extract() with filter='data' or filter='tar' on archives from untrusted sources; unexpected file access patterns where a Python process reads files outside the designated extraction directory.

The Python Software Foundation has released fixes backported to CPython 3.13 (commit b8f23e3), 3.14, and 3.15. Users should upgrade to a patched release as soon as one is available for their branch. As an immediate workaround, avoid extracting untrusted tar archives using CPython's tarfile module with the data or tar filter on CPython 3.13 and earlier. Alternatively, validate and sanitize tar archives from untrusted sources before extraction, or use the fully_trusted filter only with archives from trusted sources. The all filter (which rejects hard links) may also mitigate the issue (CPython PR #157191, CPython Commit b8f23e3, oss-security).

The vulnerability was disclosed via the Python Security Announce mailing list by Stan Ulbrych and forwarded to the oss-security list by Alan Coopersmith of Oracle on September 14, 2026. The fix was reviewed and merged by CPython core developer Petr Viktorin (encukou), with backports initiated for CPython 3.12, 3.13, 3.14, and 3.15 branches. Community discussion on the GitHub issue and pull request was technical and constructive, with contributors exploring edge cases such as hard links to symlinks pointing to directories (oss-security, CPython PR #157191).