THREATOPS

THREAT OPS › Threat News › CPython: [CVE-2026-87910] tarfile hardlink fallback ignores custom extraction filter rejection via None

CPython: [CVE-2026-87910] tarfile hardlink fallback ignores custom extraction filter rejection via None

medoss_secPublished 2026-09-11

Posted by Alan Coopersmith on Sep 11-------- Forwarded Message -------- Subject: [Security-announce][CVE-2026-87910] tarfile hardlink fallback ignores custom extraction filter rejection via None Date: Fri, 11 Sep 2026 14:24:10 +0200 From: Petr Viktorin via Security-announce <security-announce () python org> Reply-To: security-sig () pyth

Indicators of compromise

CVE-2026-87910cve

Original source: https://seclists.org/oss-sec/2026/q3/720

Same event, other sources

[NVD] CVE-2026-87910 — When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, thenvd · 2026-09-11