BIT-python-min-2026-82049

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/python-min/BIT-python-min-2026-82049.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-python-min-2026-82049
Aliases
Published
2026-09-21T09:07:26Z
Modified
2026-09-21T09:40:40Z
Summary
tarfile extraction filters allow file modification and content disclosure via hard link to symlink
Details

In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.

Database specific 
{
    "cpes":  [
        "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"
    ],
    "severity":  "High"
}
References

Affected packages

Bitnami / python-min

Package

Name
python-min
Purl
pkg:bitnami/python-min

Severity

  • 8.4 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.14.0

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/python-min/BIT-python-min-2026-82049.json"