https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 23:02:28 +0000 https://cve.radiocsirt.org/vuln/cve-2026-19672 <p><strong>Affected:</strong> Python Software Foundation CPython</p> <p>The tarfile module&#39;s tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given.</p> <p>Only empty directories are created outside the destination. Member contents are still extracted inside it. To return to the destination the member&#39;s name must contain the destination directory&#39;s own final component, so extraction into a secure randomised directory is not affected.</p> <p>This affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created.</p> <p><strong>Affected:</strong> Python Software Foundation CPython</p> <p>The tarfile module&#39;s tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given.</p> <p>Only empty directories are created outside the destination. Member contents are still extracted inside it. To return to the destination the member&#39;s name must contain the destination directory&#39;s own final component, so extraction into a secure randomised directory is not affected.</p> <p>This affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created.</p> https://cve.radiocsirt.org/vuln/cve-2026-19672