Bug 2491848 (CVE-2026-11940)

Summary:	CVE-2026-11940 python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	alinfoot, bbrownin, brasmith, cahl, cochase, dfreiber, dkeler, dranck, drow, dschmidt, dtrifiro, jburrell, jlanda, kshier, ljawale, msilmser, rbryant, rhel-process-autobot, sdawley, simaishi, stcannon, suppawar, teagle, thason, vkumar, watson-tool-maintainers, weaton, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the `tarfile.extractall()` function within Python. A remote attacker could exploit this vulnerability by providing a specially crafted archive. This archive could bypass security filters by using a hardlink that references a symlink, allowing the symlink to be recreated outside the intended destination directory. This could lead to out-of-destination file reads or writes, potentially resulting in information disclosure or arbitrary file modification.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2506027, 2506028, 2506029
Bug Blocks:

Description OSIDB Bzimport 2026-06-23 17:05:56 UTC

tarfile.extractall() with the 'data' or 'tar'
 filter could be bypassed by a crafted archive where a hardlink 
references a symlink stored at a deeper name than the hardlink itself.  
The extraction fallback validated the symlink at it's archived location 
but recreated it at the hardlink's shallower
path, letting a relative
 target the filter judged contained escape the destination directory.  
This allowed a malicious tar archive to create a symlink pointing 
outside the destination, enabling out-of-destination file reads or 
writes. This was an incomplete fix of CVE-2025-4330.

Comment 4 errata-xmlrpc 2026-08-12 11:03:38 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:54268 https://access.redhat.com/errata/RHSA-2026:54268

Comment 5 errata-xmlrpc 2026-08-18 14:16:09 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:56219 https://access.redhat.com/errata/RHSA-2026:56219

Comment 6 errata-xmlrpc 2026-08-24 11:29:42 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:58902 https://access.redhat.com/errata/RHSA-2026:58902

Comment 7 errata-xmlrpc 2026-08-24 12:29:10 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:58901 https://access.redhat.com/errata/RHSA-2026:58901

Comment 8 errata-xmlrpc 2026-08-24 13:01:10 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:58928 https://access.redhat.com/errata/RHSA-2026:58928

Comment 9 errata-xmlrpc 2026-08-24 14:35:01 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:58971 https://access.redhat.com/errata/RHSA-2026:58971

Comment 10 errata-xmlrpc 2026-08-24 16:27:50 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:59009 https://access.redhat.com/errata/RHSA-2026:59009