Description

encukou

opened on May 7, 2026

Issue body actions

tarfile.data_filter can be bypassed using a chain of empty-named symlinks (name="").

Linked PRs

• gh-149486: tarfile.data_filter: validate written link target #149487
• [3.15] gh-149486: tarfile.data_filter: validate written link target (GH-149487) #149553
• [3.14] gh-149486: tarfile.data_filter: validate written link target (GH-149487) #149554
• [3.13] gh-149486: tarfile.data_filter: validate written link target (GH-149487) #149555
• [3.12] gh-149486: tarfile.data_filter: validate written link target (GH-149487) #149556
• [3.11] gh-149486: tarfile.data_filter: validate written link target (GH-149487) #150904
• [3.10] gh-149486: tarfile.data_filter: validate written link target (GH-149487) #153180

Activity

1. encukou

   self-assigned this

   on May 7, 2026
2. encukou

   added

   type-securityA security issueA security issue

   stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directory

   on May 7, 2026
3. StanFromIreland

   added this to Tarfile issues 🗄️on May 7, 2026
4. encukou

   added 4 commits that reference this issue on May 8, 2026

   gh-149486: tarfile.data_filter: validate written link target (GH-149487)

   5784119

   [3.15] gh-149486: tarfile.data_filter: validate written link target (G…

   5cf47a2

   [3.14] gh-149486: tarfile.data_filter: validate written link target (G…

   74cca9a

   [3.13] gh-149486: tarfile.data_filter: validate written link target (G…

   0478bd8
5. Yhg1s

   added a commit that references this issue on May 18, 2026

   [3.12] gh-149486: tarfile.data_filter: validate written link target (G…

   0d28f5e
6. pablogsal

   added 2 commits that reference this issue on Jul 4, 2026

   [3.11] gh-149486: tarfile.data_filter: validate written link target (G…

   10a13be

   [3.10] gh-149486: tarfile.data_filter: validate written link target (G…

   c063191
7. StanFromIreland

   closed this as completedon Jul 6, 2026
8. github-project-automation

   moved this to Done in Tarfile issues 🗄️on Jul 6, 2026
9. mcepl

   added 4 commits that reference this issue on Sep 18, 2026

   [CVE-2026-7774] tarfile.data_filter: validate written link target

   7700790

   [CVE-2026-7774] tarfile.data_filter: validate written link target

   edcdad3

   [CVE-2026-7774] tarfile.data_filter: validate written link target

   d9ea6a4

   [CVE-2026-7774] tarfile.data_filter: validate written link target

   b41d1bb
10. mcepl

    added 3 commits that reference this issue on Oct 1, 2026

    [CVE-2026-7774] tarfile.data_filter: validate written link target

    76fa234

    [CVE-2026-7774] tarfile.data_filter: validate written link target

    af2bcfb

    [CVE-2026-7774] tarfile.data_filter: validate written link target

    adfbd38
11. icanhasmath

    added a commit that references this issue on Oct 28, 2026

    [3.10] pythongh-149486: tarfile.data_filter: validate written link ta…

    b6f6db1

Issue actions