CVE-2026-11940 Details

A vulnerability in the Python tarfile module allows for symlink escape through hardlink-extraction fallback. This issue arises when a crafted tar archive creates a hardlink that references a symlink located deeper in the directory structure. The extraction process validates the symlink's original location but recreates it at the hardlink's shallower path. This can cause a relative target, deemed safe by the filter, to escape the intended destination directory. As a result, the malicious archive can create a symlink pointing outside the destination, potentially leading to unauthorized file reads or writes beyond the designated directory. This vulnerability affects Python versions 3.10, 3.11, 3.12, 3.13, 3.14, and 3.15.

Users can update to the latest version of Python, where this vulnerability has been addressed. Instructions for updating can be found in the Python documentation.