CVE-2026-114583 Python Software Foundation CVE debrief

Who should care

Python developers and maintainers, especially those handling untrusted archives or using tarfile in their applications, should assess and verify tarfile usage. This includes reviewing archive extraction processes, implementing compensating controls, and monitoring for potential exploitation attempts. Additionally, security teams and vulnerability management teams should be aware of this vulnerability and its potential impacts on their organization's assets

Why it matters

CVE-2026-114583 allows crafted tar archives to bypass tarfile.tar_filter, potentially writing outside intended extraction directories. Python developers and maintainers should assess and verify tarfile usage in their applications, especially those handling untrusted archives.

• Verify tarfile usage and update applications to handle untrusted archives securely.
• Implement compensating controls to prevent unauthorized file writes.

Technical summary

The tarfile.tar_filter in Python could be bypassed using crafted link entries in tar archives, allowing malicious archives to write files outside the intended extraction directory. This vulnerability affects the tarfile module in Python, specifically the tarfile.tar_filter component. Affected product context includes Python applications that use the tarfile module to extract archives from untrusted sources. Defensive impact involves the potential for unauthorized file writes and code execution. Source-grounded technical framing suggests that developers and maintainers should assess and verify tarfile usage in their applications.

Defensive priority

Assess and verify tarfile usage in Python applications, especially those handling untrusted archives.

Recommended defensive actions

• Verify and update Python applications using tarfile to handle untrusted archives.
• Implement compensating controls, such as validating archive contents before extraction.
• Monitor for and track potential exploitation attempts.
• Review and adjust archive extraction processes to ensure they align with security best practices.
• Conduct a thorough review of the application's attack surface to identify potential vulnerabilities.
• Implement additional logging and monitoring to detect suspicious activity related to tarfile usage.
• Consider applying patches or updates provided by the vendor as soon as possible.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Python's tarfile module. Evidence limits are based on the information available from these sources. Known affected scope includes Python applications using the tarfile module to extract archives from untrusted sources. Unknown affected scope may exist in other applications or use cases not explicitly mentioned in the CVE record or NVD entry. Defenders should verify tarfile usage in their applications, especially those handling untrusted archives, and assess the need

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.