https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 23 Oct 2026 06:43:39 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-114583 <p>tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter=&#34;tar&#34; to write files outside the destination directory, subject to the permissions of the extracting process.</p> <p>This is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter.</p> <p>tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter=&#34;tar&#34; to write files outside the destination directory, subject to the permissions of the extracting process.</p> <p>This is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter.</p> https://db.gcve.eu/vuln/fkie_cve-2026-114583 https://db.gcve.eu/vuln/ghsa-mw29-5qxh-rr87 <p>tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter=&#34;tar&#34; to write files outside the destination directory, subject to the permissions of the extracting process.</p> <p>This is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter.</p> <p>tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter=&#34;tar&#34; to write files outside the destination directory, subject to the permissions of the extracting process.</p> <p>This is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter.</p> https://db.gcve.eu/vuln/ghsa-mw29-5qxh-rr87