CVE-2026-4360

A flaw was found in the Python Tarfile.extract() function. This vulnerability occurs when processing untrusted tar files containing hardlinks, as the filter parameter is not correctly enforced. An attacker could exploit this to write files with unintended user or group ownership, potentially leading to unauthorized modifications or privilege issues on the system.

This Moderate flaw in Python's Tarfile module allows a local attacker with low privileges to achieve a high integrity impact. By tricking a user into extracting a specially crafted untrusted tar file containing hardlinks, the attacker could cause files to be written with unexpected ownership, potentially leading to unauthorized file modification.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.