CVE-2026-11940

描述

tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself.  The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory.  This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330.

如何修補 CVE-2026-11940

目前尚未發布修補版本。可考慮移除受影響套件,或參考下方連結中的上游建議。

• —未列出修補版本
• —未列出修補版本
• —未列出修補版本

CVE-2026-11940 正在被利用嗎?

低 — EPSS 為 0.6%,目前沒有觀察到大規模利用活動。

受影響套件(3)

• from 0
• from 0
• from 0

CVSS 分數

參考連結(9)

• WEBgithub.com/python/cpython/commit/27dd970bf6b17ebca7c8ed486a40ab043ed7af8f
• WEBgithub.com/python/cpython/commit/672825e2f36a57e173959b0d9d409d4560dab8df
• WEBgithub.com/python/cpython/commit/771d12dda5140313db0ac550292987975651bbde
• WEBgithub.com/python/cpython/commit/79c06bd5c6afa3c440d50faf7ee1b147c8832b4c