tarfile `data`/`tar` filter bypass via hard link to a symlink
Open
@StanFromIreland is already working on this.
Since Sep 8, 2026.
3.10
3.11
3.12
3.13
stdlib
type-security
- Dominant language
- Python
- Stars
- 77.2k
- Forks
- 35.9k
- PR merge metrics
- PR metrics pending
Description
On CPython 3.13.15 for Linux, an attacker-controlled tar archive extracted with the tar or data filter can make tarfile change the permissions and modification time of an existing file outside the extraction directory. The archive also leaves a path inside the extracted tree that resolves to the outside file. Opening that path returns the outside file's content.
This was incidentally fixed by https://github.com/python/cpython/commit/5a57248b22ad3b9aafcaaadae2c304a1923daeca for 3.14+ which changed os.link to use AT_SYMLINK_FOLLOW.
Linked PRs
- gh-157191
- gh-157192
- gh-157261
- gh-157262
- gh-157454
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.