CVE-2026-4360
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts c
CVSS
5.3
Medium
EPSS
0.2%
p14
KEV
—
Exploit Today
4
0-100
Published: Jun 30, 2026 · Last modified: Jul 9, 2026 · CWE-281
0.2%EPSS · 30 days0.3%
2026-07-012026-07-18
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
- github.comhttps://github.com/python/cpython/commit/5e0ef3f1afe892e4f64eb83368db57ac4c40cba0
- github.comhttps://github.com/python/cpython/commit/7b57e8d51446297b8c7c482d224bc5f1938e4301
- github.comhttps://github.com/python/cpython/commit/7ccdbaba2c54250a70d7f25632152df7655a5e0a
- github.comhttps://github.com/python/cpython/commit/d2b2f5eacab4dd48446b63340613b05dcbbf0b44
- github.comhttps://github.com/python/cpython/commit/eee3ddf0ca10283cc7fea724aae9cd8665f8d15e
- github.comhttps://github.com/python/cpython/issues/151987
- github.comhttps://github.com/python/cpython/pull/151988
- mail.python.orghttps://mail.python.org/archives/list/security-announce@python.org/thread/TWZW2PC2AZOV6FENIHFSRC63OM7MBGSB/
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2024-463109.1 CRI82.4%
——25Incorrect Access Control in Cfx.re FXServer v9601 and earlier allows unauthenticated users to modify and read arbitrary user data via exposed API endpoint14dCVE-2025-551309.1 CRI73.6%
——22A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise.
This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.4dCVE-2022-385778.8 HIG70.4%
——21ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile page. This vulnerability allows attackers to escalate normal users to Administrators.10dCVE-2024-548799.1 CRI55.9%
——17SeaCMS V13.1 is vulnerable to Incorrect Access Control. A logic flaw can be exploited by an attacker to allow any user to recharge members indefinitely.14dCVE-2023-346728.8 HIG50.2%
——15Improper Access Control leads to adding a high-privilege user affecting Elenos ETG150 FM transmitter running on version 3.12 by exploiting user's role within the admin profile. An attack could occur over the public Internet in some cases.10dCVE-2026-398329.1 CRI41.0%
——12When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.1d