AZL-101784
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-101784.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-101784
- Upstream
- Published
- 2026-09-14T19:17:50Z
- Modified
- 2026-09-18T05:37:08Z
- Summary
- CVE-2026-82049 affecting package python3 3.12.14-1
- Details
-
In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.
- References