CVE-2026-4360

In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.

• CWE-281

• https://github.com/python/cpython/commit/0367912be336348b30572f8029cec4a282782d92
• https://github.com/python/cpython/commit/5e0ef3f1afe892e4f64eb83368db57ac4c40cba0Patch
• https://github.com/python/cpython/commit/7b57e8d51446297b8c7c482d224bc5f1938e4301Patch
• https://github.com/python/cpython/commit/7ccdbaba2c54250a70d7f25632152df7655a5e0aPatch
• https://github.com/python/cpython/commit/cf23b9153181062150d061468b6d24af33fe214f
• https://github.com/python/cpython/commit/d2b2f5eacab4dd48446b63340613b05dcbbf0b44Patch
• https://github.com/python/cpython/commit/eee3ddf0ca10283cc7fea724aae9cd8665f8d15ePatch
• https://github.com/python/cpython/issues/151987Issue Tracking, Patch
• https://github.com/python/cpython/pull/151988Issue Tracking, Patch
• https://mail.python.org/archives/list/security-announce@python.org/thread/TWZW2PC2AZOV6FENIHFSRC63OM7MBGSB/Issue Tracking, Vendor Advisory

Published

Jun 30, 2026

Last Modified

Aug 6, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-43581OpenClaw before 2026.4.10 contains an improper network bindi…9.6
• CVE-2026-43582OpenClaw before 2026.4.10 contains a server-side request for…6.3
• CVE-2026-43583OpenClaw versions 2026.4.10 before 2026.4.14 fail to persist…6.5
• CVE-2026-43584OpenClaw before 2026.4.10 contains an insufficient environme…8.8
• CVE-2026-43585OpenClaw before 2026.4.15 captures resolved bearer-auth conf…9.8
• CVE-2026-4359A compromised third party cloud server or man-in-the-middle …3.7
• CVE-2026-43606Observable Timing Discrepancy in the AMD Vitis Libraries ECD…8.5
• CVE-2026-43616Detect-It-Easy prior to 3.21 contains a path traversal vulne…7.8
• CVE-2026-43617Rsync version 3.4.2 and prior contain an authorization bypas…6.3
• CVE-2026-43618Rsync version 3.4.2 and prior contain an integer overflow vu…8.1
• CVE-2026-43619Rsync version 3.4.2 and prior contain symlink race condition…7.2
• CVE-2026-4362The ElementsKit Elementor Addons plugin for WordPress is vul…6.5