Fluid Attacks Database

Description

In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
pypi	python	>=0 <3.14.0b1	3.14.0b1
debian 13	pypy3	=7.3.19+dfsg-2 \|\| =7.3.20+dfsg-1 \|\| =7.3.20+dfsg-2 \|\| =7.3.20+dfsg-3 \|\| =7.3.20+dfsg-4 \|\| =7.3.21+dfsg-1 \|\| =7.3.21+dfsg-2 \|\| =7.3.21+dfsg-3 \|\| =7.3.21+dfsg-4 \|\| =7.3.22+dfsg-1 \|\| =7.3.23+dfsg-1 \|\| =7.3.23+dfsg-2	-
debian 13	python3.13	=3.13.11-1 \|\| =3.13.12-1 \|\| =3.13.14-1 \|\| =3.13.15-1 \|\| =3.13.5-2 \|\| =3.13.5-2+deb13u1 \|\| =3.13.5-2+deb13u2 \|\| =3.13.5-2+deb13u3 \|\| =3.13.5-2+deb13u4 \|\| =3.13.5-2+deb13u5 \|\| =3.13.6-1 \|\| =3.13.7-1 \|\| =3.13.8-1 \|\| =3.13.9-1	-
debian 14	python3.13	=3.13.11-1 \|\| =3.13.12-1 \|\| =3.13.14-1 \|\| =3.13.15-1 \|\| =3.13.5-2 \|\| =3.13.6-1 \|\| =3.13.7-1 \|\| =3.13.8-1 \|\| =3.13.9-1	-
debian 14	pypy3	=7.3.19+dfsg-2 \|\| =7.3.20+dfsg-1 \|\| =7.3.20+dfsg-2 \|\| =7.3.20+dfsg-3 \|\| =7.3.20+dfsg-4 \|\| =7.3.21+dfsg-1 \|\| =7.3.21+dfsg-2 \|\| =7.3.21+dfsg-3 \|\| =7.3.21+dfsg-4 \|\| =7.3.22+dfsg-1 \|\| =7.3.23+dfsg-1 \|\| =7.3.23+dfsg-2	-

Aliases

1. CVE-2026-820492. NVD-2026-820493. OSV-2026-820494. OSV-DEBIAN-2026-820495. GCVE-2026-820496. https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82049.json7. mail.python.org8. SECURITY-TRACKER-CVE-2026-82049

References

1. http://www.openwall.com/lists/oss-security/2026/09/14/272. https://github.com/python/cpython/issues/1571903. https://github.com/python/cpython/commit/5a57248b22ad3b9aafcaaadae2c304a1923daeca4. https://github.com/python/cpython/commit/b38be2e6cf9d989075ab73412c63e003ebad4ff35. https://github.com/python/cpython/commit/b8f23e307097552eaea2604383a12ab280520d0d6. https://github.com/python/cpython/pull/157191

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.