Поиск уязвимостей
Количество 32
Количество 32
CVE-2026-11940
tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory. This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330.
CVE-2026-11940
tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory. This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330.
CVE-2026-11940
tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory. This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330.
CVE-2026-11940
tarfile.extractall() with the 'data' or 'tar' filter could be bypasse ...
ROS-20261103-80-0078
Уязвимость python3.11
ROS-20261103-80-0077
Уязвимость python3.8
ROS-20261103-73-0080
Уязвимость python3.11
ROS-20261103-73-0079
Уязвимость python3
RLSA-2026:59009
Important: python3.12 security update
RLSA-2026:58971
Important: python3.12 security update
RLSA-2026:58928
Important: python3.14 security update
RLSA-2026:58902
Important: python3.12 security update
RLSA-2026:58901
Important: python3.14 security update
RLSA-2026:56219
Important: python3 security update
RLSA-2026:54268
Important: python3.9 security update
GHSA-9mc4-rqmq-h467
tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory. This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330.
ELSA-2026-59009
ELSA-2026-59009: python3.12 security update (IMPORTANT)
ELSA-2026-58971
ELSA-2026-58971: python3.12 security update (IMPORTANT)
ELSA-2026-58928
ELSA-2026-58928: python3.14 security update (IMPORTANT)
ELSA-2026-58901
ELSA-2026-58901: python3.14 security update (IMPORTANT)
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2026-11940 tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory. This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330. | 1% Низкий | 5 месяцев назад | |
 | CVE-2026-11940 tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory. This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330. | CVSS3: 7.3 | 1% Низкий | 5 месяцев назад |
 | CVE-2026-11940 tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory. This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330. | 1% Низкий | 5 месяцев назад | |
| CVE-2026-11940 tarfile.extractall() with the 'data' or 'tar' filter could be bypasse ... | 1% Низкий | 5 месяцев назад | |
 | ROS-20261103-80-0078 Уязвимость python3.11 | 1% Низкий | 8 дней назад | |
| ROS-20261103-80-0077 Уязвимость python3.8 | 1% Низкий | 8 дней назад | |
| ROS-20261103-73-0080 Уязвимость python3.11 | 1% Низкий | 8 дней назад | |
| ROS-20261103-73-0079 Уязвимость python3 | 1% Низкий | 8 дней назад | |
 | RLSA-2026:59009 Important: python3.12 security update | 1% Низкий | 3 месяца назад | |
| RLSA-2026:58971 Important: python3.12 security update | 1% Низкий | 3 месяца назад | |
| RLSA-2026:58928 Important: python3.14 security update | 1% Низкий | 3 месяца назад | |
| RLSA-2026:58902 Important: python3.12 security update | 1% Низкий | 3 месяца назад | |
| RLSA-2026:58901 Important: python3.14 security update | 1% Низкий | 3 месяца назад | |
| RLSA-2026:56219 Important: python3 security update | 1% Низкий | 3 месяца назад | |
| RLSA-2026:54268 Important: python3.9 security update | 1% Низкий | 3 месяца назад | |
| GHSA-9mc4-rqmq-h467 tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory. This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330. | 1% Низкий | 5 месяцев назад | |
| ELSA-2026-59009 ELSA-2026-59009: python3.12 security update (IMPORTANT) | 1% Низкий | 3 месяца назад | |
| ELSA-2026-58971 ELSA-2026-58971: python3.12 security update (IMPORTANT) | 1% Низкий | 3 месяца назад | |
| ELSA-2026-58928 ELSA-2026-58928: python3.14 security update (IMPORTANT) | 1% Низкий | 3 месяца назад | |
| ELSA-2026-58901 ELSA-2026-58901: python3.14 security update (IMPORTANT) | 1% Низкий | 3 месяца назад |
Уязвимостей на страницу