Skip to content

tarfile.data_filter doesn't handle symlinks with empty names #149486

Closed
Closed
tarfile.data_filter doesn't handle symlinks with empty names#149486
Assignees
encukou
Labels
stdlibStandard Library Python modules in the Lib/ directorytype-securityA security issue

Activity

  1. encukou
    self-assigned this
    on May 7, 2026
  2. encukou
    added
    type-securityA security issue
    stdlibStandard Library Python modules in the Lib/ directory
    on May 7, 2026
  3. StanFromIreland
    added this to Tarfile issues 🗄️on May 7, 2026
  4. encukou
    added 4 commits that reference this issue on May 8, 2026

    gh-149486: tarfile.data_filter: validate written link target (GH-149487)

    5784119

    [3.15] gh-149486: tarfile.data_filter: validate written link target (G…

    5cf47a2

    [3.14] gh-149486: tarfile.data_filter: validate written link target (G…

    74cca9a

    [3.13] gh-149486: tarfile.data_filter: validate written link target (G…

    0478bd8
  5. Yhg1s
    added a commit that references this issue on May 18, 2026

    [3.12] gh-149486: tarfile.data_filter: validate written link target (G…

    0d28f5e
  6. pablogsal
    added 2 commits that reference this issue on Jul 4, 2026

    [3.11] gh-149486: tarfile.data_filter: validate written link target (G…

    10a13be

    [3.10] gh-149486: tarfile.data_filter: validate written link target (G…

    c063191
  7. StanFromIreland
    closed this as completedon Jul 6, 2026
  8. github-project-automation
    moved this to Done in Tarfile issues 🗄️on Jul 6, 2026
  9. mcepl
    added 4 commits that reference this issue on Sep 18, 2026

    [CVE-2026-7774] tarfile.data_filter: validate written link target

    7700790

    [CVE-2026-7774] tarfile.data_filter: validate written link target

    edcdad3

    [CVE-2026-7774] tarfile.data_filter: validate written link target

    d9ea6a4

    [CVE-2026-7774] tarfile.data_filter: validate written link target

    b41d1bb
  10. mcepl
    added 3 commits that reference this issue on Oct 1, 2026

    [CVE-2026-7774] tarfile.data_filter: validate written link target

    76fa234

    [CVE-2026-7774] tarfile.data_filter: validate written link target

    af2bcfb

    [CVE-2026-7774] tarfile.data_filter: validate written link target

    adfbd38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

stdlibStandard Library Python modules in the Lib/ directorytype-securityA security issue

Projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions