GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — [3.11] gh-161323: Refuse drive-relative paths in tarfile extraction filters (GH-161334) by miss-islington · Pull Request #161359 · python/cpython

Conversation

@miss-islington

@miss-islington miss-islington commented Nov 4, 2026

Copy link
Copy Markdown
Contributor
  • tarfile: Windows same-drive drive-relative symlink not caught by data filter #161323: Refuse drive-relative paths in tarfile extraction filters

On Windows, os.path.join() does not put a name such as 'C:foo' below a
destination that has no drive, so the 'tar' and 'data' filters now refuse
names and link targets with a drive, after normalization.
Fixes CVE-2026-107784.

reported by Girish Konda

ANT-2026-RSL1F4AT
(cherry picked from commit e4c751b)

Co-authored-by: Gregory P. Smith [email protected]
Co-authored-by: Petr Viktorin [email protected]

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@gpshead @encukou @miss-islington
pythongh-161323: Refuse drive-relative paths in tarfile extraction fi…
72ba1c0 
…lters (pythonGH-161334)

* pythongh-161323: Refuse drive-relative paths in tarfile extraction filters

On Windows, os.path.join() does not put a name such as 'C:foo' below a
destination that has no drive, so the 'tar' and 'data' filters now refuse
names and link targets with a drive, after normalization.
Fixes CVE-2026-107784.

reported by Girish Konda

ANT-2026-RSL1F4AT
(cherry picked from commit e4c751b)

Co-authored-by: Gregory P. Smith <[email protected]>
Co-authored-by: Petr Viktorin <[email protected]>
@miss-islington
miss-islington requested a review from ethanfurman as a code owner November 4, 2026 21:25
@bedevere-app bedevere-app Bot added the awaiting review label Nov 4, 2026
This was referenced Nov 4, 2026
tarfile: Windows same-drive drive-relative symlink not caught by data filter #161323
Open
gh-161323: Refuse drive-relative paths in tarfile extraction filters #161334
Merged
@read-the-docs-community

read-the-docs-community Bot commented Nov 4, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

Documentation build overview

📚 cpython-previews | 🛠️ Build #35760398 | 📁 Comparing 7785b67 against main (e4c751b)

  🔍 Preview build  

538 files changed · + 18 added · ± 435 modified · - 85 deleted

+ Added

  • c-api/objbuffer.html
  • distutils/_setuptools_disclaimer.html
  • distutils/apiref.html
  • distutils/builtdist.html
  • distutils/commandref.html
  • distutils/configfile.html
  • distutils/examples.html
  • distutils/extending.html
  • distutils/index.html
  • distutils/introduction.html
  • and 8 more...

± Modified

  • about.html
  • bugs.html
  • copyright.html
  • glossary.html
  • index.html
  • license.html
  • py-modindex.html
  • c-api/allocation.html
  • c-api/apiabiversion.html
  • c-api/arg.html
  • and 425 more...

- Deleted

  • 404.html
  • improve-page-nojs.html
  • improve-page.html
  • _static/tachyon-example-flamegraph.html
  • _static/tachyon-example-heatmap.html
  • builtins/constants.html
  • builtins/exceptions.html
  • builtins/functions.html
  • builtins/index.html
  • builtins/stdtypes.html
  • and 75 more...
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@gpshead gpshead added the release-blocker label Nov 6, 2026
@github-project-automation github-project-automation Bot added this to Release and Deferred blockers 🚫 Nov 6, 2026
@github-project-automation github-project-automation Bot moved this to Todo in Release and Deferred blockers 🚫 Nov 6, 2026
@gpshead gpshead assigned pablogsal Nov 6, 2026
@hugovk hugovk mentioned this pull request Nov 9, 2026
[3.11] gh-128504: Pin the doctest workflow to Ubuntu 24.04 #161664
Merged
@hugovk
Merge branch '3.11' into backport-e4c751b-3.11
7785b67
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ethanfurman ethanfurman Awaiting requested review from ethanfurman ethanfurman is a code owner

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@pablogsal pablogsal

Labels

awaiting review release-blocker

Projects

Release and Deferred blockers 🚫
Status: Todo

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

4 participants

@miss-islington @gpshead @pablogsal @hugovk
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402520 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.