{"id":"PSF-2026-41","details":"In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.","aliases":["CVE-2026-82049","PSF-0000-CVE-2026-82049"],"modified":"2026-09-15T02:01:52.757811Z","published":"2026-09-14T19:14:03.873Z","database_specific":{"cwe_ids":[]},"references":[{"type":"FIX","url":"https://github.com/python/cpython/commit/5a57248b22ad3b9aafcaaadae2c304a1923daeca"},{"type":"REPORT","url":"https://github.com/python/cpython/issues/157190"},{"type":"WEB","url":"https://github.com/python/cpython/pull/157191"},{"type":"ADVISORY","url":"https://mail.python.org/archives/list/security-announce@python.org/thread/EFJWGAZJA56AKSBR2WHMHQZO7RRLZPRH/"},{"type":"FIX","url":"https://github.com/python/cpython/commit/b38be2e6cf9d989075ab73412c63e003ebad4ff3"},{"type":"FIX","url":"https://github.com/python/cpython/commit/b8f23e307097552eaea2604383a12ab280520d0d"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/python/cpython","events":[{"introduced":"0"},{"fixed":"5a57248b22ad3b9aafcaaadae2c304a1923daeca"},{"fixed":"b38be2e6cf9d989075ab73412c63e003ebad4ff3"},{"fixed":"b8f23e307097552eaea2604383a12ab280520d0d"}]}],"versions":["v3.13.15","v3.13.14","v3.15.0b1","v3.13.13","v3.15.0a8","v3.15.0a7","v3.15.0a6","v3.13.12","v3.15.0a5","v3.15.0a4","v3.15.0a3","v3.13.11","v3.13.10","v3.15.0a2","v3.15.0a1","v3.13.8","v3.13.7","v3.13.6","v3.13.5","v3.13.4","v3.14.0b1","v3.13.3","v3.14.0a7","v3.14.0a6","v3.14.0a5","v3.13.2","v3.14.0a4","v3.14.0a3","v3.13.1","v3.14.0a2","v3.14.0a1","v3.13.0","v3.13.0rc3","v3.13.0rc2","v3.13.0rc1","v3.13.0b4","v3.13.0b3","v3.13.0b2","v3.13.0b1","v3.13.0a6","v3.13.0a5","v3.13.0a4","v3.13.0a3","v3.13.0a2","v3.13.0a1","v3.12.0b1","v3.12.0a7","v3.12.0a6","v3.12.0a5","v3.12.0a4","v3.12.0a3","v3.12.0a2","v3.12.0a1","v3.11.0b1","v3.11.0a7","v3.11.0a6","v3.11.0a5","v3.11.0a4","v3.11.0a3","v3.10.0a7","v3.10.0a1","v3.9.0a2","v3.7.0a2","v3.6.0b1","v3.6.0a3","v3.5.0b1","v3.5.0a4","v3.5.0a3","v3.5.0a2","v3.5.0a1","v3.4.0b3","v3.4.0b2","v3.4.0b1","v3.4.0a4","v3.4.0a3","v3.4.0a2","v3.4.0a1","v3.3.0rc3","v3.3.0rc2","v3.3.0rc1","v3.3.0b2","v3.3.0b1","v3.3.0a4","v3.3.0a3","v3.3.0a2","v3.2rc3","v3.2rc2","v3.2rc1","v3.2b2","v3.2b1","v3.2a4","v3.2a3","v3.2a2","v3.2a1","v3.1","v3.1rc2","v3.1rc1","v3.1b1","v3.1a2","v3.1a1","v3.0rc3","v3.0rc2","v3.0rc1","v3.0b3","v3.0b2","v3.0b1","v3.0a5","v3.0a4","v3.0a3","v3.0a2","v3.0a1","v2.4","v2.4c1","v2.4b2","v2.4b1","v2.4a3","v2.4a2","v2.4a1","v2.3c2","v2.3c1","v2.2a3","v2.1","v2.1c2","v2.1c1","v2.1b2","v2.1b1","v2.1a2","v2.1a1","v2.0","v2.0c1","v2.0b2","v2.0b1","v1.6a2","v1.6a1","v1.5.2","v1.5.2c1","v1.5.2b2","v1.5.2b1","v1.5.2a2","v1.5.2a1","v1.5.1","v1.5","v1.5b2","v1.5b1","v1.5a4","v1.5a3","v1.5a2","v1.5a1","v1.4","v1.4b3","v1.4b2","v1.4b1","v1.3","v1.3b1","v1.2","v1.2b4","v1.2b3","v1.2b2","v1.2b1","v1.1.1","v1.1","v1.0.2","v1.0.1","v0.9.9","v0.9.8"],"database_specific":{"source":"https://github.com/psf/advisory-database/blob/main/advisories/python/PSF-2026-41.json","vanir_signatures_modified":"2026-09-15T02:01:52Z","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/5a57248b22ad3b9aafcaaadae2c304a1923daeca","target":{"file":"Modules/posixmodule.c","function":"os_symlink_impl"},"deprecated":false,"digest":{"function_hash":"267959810012917770400690325238361302404","length":1834},"id":"PSF-2026-41-0287fda3"},{"signature_version":"v1","source":"https://github.com/python/cpython/commit/5a57248b22ad3b9aafcaaadae2c304a1923daeca","target":{"file":"Modules/clinic/posixmodule.c.h"},"deprecated":false,"digest":{"line_hashes":["84214301494753001192888032913794937585","41820490358286174222816075072646282822","273419541879179450879866280856998132849","160074586628009698771565341913161200058","285542558134630096667834399153434937624","95809919400751122606823033150957223699","205355179740128963671618134888183651889","289978647606376248309152325909124168419"],"threshold":0.9},"id":"PSF-2026-41-03669b97","signature_type":"Line"},{"source":"https://github.com/python/cpython/commit/5a57248b22ad3b9aafcaaadae2c304a1923daeca","target":{"file":"Modules/clinic/posixmodule.c.h","function":"os_link"},"deprecated":false,"digest":{"function_hash":"155770192408540012751021593359598745768","length":1834},"id":"PSF-2026-41-05c31dff","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["203424791401373496045590391218869865705","313079788090789726122159250470243304044","237403817052961879920167401361366969995","101439833449485421617063933278822806943","12490333274840592807265937885357558576","264431914624868132810463621464930909438","123316591950073319570860478623297113427","116203552124651182052084036787769804793","83324613508651392868973815111744286738","280739953835892540517752098634947259736","105733832417777969738272284074996172457","99822774897598718637573640037692290109","211134274670953056070986941618821441490","67046948812929158767660561956935670267","208959891089041310964022438250938767999","255473495192449174325830428891450179669","179298131828077067486928114420023927128","262542643625373520623077720862038664032","214005891481496413566509830760452257363","302365271359307276180250215863862971345","226076795346784479966366381806937975762","62883986758050273003566039469640760223","67086347400937215842840498353998932318","295507655888536602034544638049242269277","13828991224579563758415941228328663113","51624285339312389819538633254388956615","141814318202201729125254407378130361004","98402834040705734929136251820299953234","265378927170351459319686720672730588998","43772310371581454102349126441616598847","109617800509052927117376120082287039209","128392366501938626702132264483095032303","33786832729959356854284186128653483420","259586006219542252760222339155765531779","190359421230921045605483850730147563107","207829324267667416446376513298159750051","112101083800343848386420737755953854968","145691250165199375913340985234214485812","71846497447566257206836217155840432520","111781562327111901435803968549474663044","293011440281289237335319891999287686387","76949906967122270846545604202931712666","68548996976066696686926919400924937596","162553950198253833581359178969179618782","298463966982082737810995120983889078115","211626883684831996526311642383641804594","139822868071513177808439850508281300823","16111072626440697363323075176238003405","335321198478416727494434298753925803633","178528520044192166307250074171208980140","4544111393618610573014631413676193190","312760904726209197309373779437519011399","323717220786171848388476504517209503983","143020453670807975619238195962928248769","326028688853017099944501026277521891316","239644462175867125428438233039224081569","181143033114746841424326967779776977534","271266568863838759231241171940671621635","102083408656890282324489806785264895354","185106787041331990927351312596553777246","42814679058687648993325212295210940143","52938278578312489992361417024250612247","294159336367666910694871408087919496191","209886228092566369685295756805883614242","290495828566685465131074891424079105299","217091734582334569644588361808542029166","152504578666146781147681332475587982648","190981149355808952923904101378361956377","293185464402666286521481061449015989440","195212475728559534436945791554389338302","171567684014406604562465682193377382246","313802588904198001754198445410328586280","163337599658659815753087465674058202175","57081688230146547022366944769926565344","170472299840265806738760471649788138457","123264652703492928731334141227959584743","293185464402666286521481061449015989440","99996592912685908450682918727202438946","36580374731113901357836134457673797159","150896569229729246430339978801704232328","18898566074600344622281036429171220543","75183871821927807201510208195830184460","269701731251847493160270887566608944997","294811852134562161863889822351365884972"]},"id":"PSF-2026-41-45e38458","signature_type":"Line","signature_version":"v1","source":"https://github.com/python/cpython/commit/5a57248b22ad3b9aafcaaadae2c304a1923daeca","target":{"file":"Modules/posixmodule.c"}},{"deprecated":false,"digest":{"function_hash":"12855332029521926307782785870798858747","length":1729},"id":"PSF-2026-41-76a27062","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/5a57248b22ad3b9aafcaaadae2c304a1923daeca","target":{"file":"Modules/posixmodule.c","function":"os_link_impl"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/5a57248b22ad3b9aafcaaadae2c304a1923daeca","target":{"file":"Modules/posixmodule.c","function":"internal_rename"},"deprecated":false,"digest":{"function_hash":"253628542589482117839778400615606067596","length":1455},"id":"PSF-2026-41-f84176d6"}]}}],"schema_version":"1.9.0"}