Security Feed
See the latest insights and analysis from our MDR team.
RSS for SlackCVE-2026-82049
By Roy Kalfon |
16 September 2026
CVE-2026-82049 – CPython tarfile extraction filter flaw enables hardlink-to-symlink path escape
In CPython 3.13 and earlier, tarfile data/tar extraction filters mishandle crafted archives with a hard link to a symbolic link. Extraction can change mode/mtime of a file outside the destination directory or expose that file’s contents inside the extracted tree. Upgrade to 3.14.0b1 or later.