CVE-2026-19672 Overview
CVE-2026-19672 affects the Python tarfile module's tar and data extraction filters. The filters create directories outside the intended destination when processing archive members whose names traverse outside the destination and return to it, such as ../evil/../dest/sub/file. The containment check uses the resolved path, but intermediate directories are created from the raw member name before path resolution occurs.
Only empty directories are created outside the destination. Member contents remain extracted inside the target directory. The issue affects POSIX platforms only. On Windows, .. components collapse before the path reaches the filesystem, preventing external directory creation.
Critical Impact
An attacker who supplies a crafted tar archive can force creation of empty directories at arbitrary POSIX filesystem paths outside the extraction destination, potentially enabling filesystem pollution or interfering with other processes.
Affected Products
- CPython tarfile module on POSIX platforms
- Applications using tarfile extraction filters (tar and data)
- Deployments where the destination directory name is predictable
Discovery Timeline
- 2026-08-19 - CVE-2026-19672 published to NVD
- 2026-08-19 - Last updated in NVD database
Technical Details for CVE-2026-19672
Vulnerability Analysis
The vulnerability is a path traversal issue [CWE-22] in the Python standard library's tarfile module. Python 3.12 introduced extraction filters (tar, data, and fully_trusted) to harden archive extraction against malicious member names. The tar and data filters validate the final resolved path against the destination directory. This check correctly rejects members that end outside the destination.
However, the filters create intermediate parent directories using the member's raw name before final path resolution. A member named ../evil/../dest/sub/file resolves back inside dest, but the interim path components trigger os.makedirs calls that create ../evil on the filesystem. The final file contents still land inside the destination, so the containment guarantee holds for data but not for directory side effects.
Exploitation requires the attacker to know the final component of the destination directory, because the member name must include that component to return to the destination after traversal. Extraction into randomized directories (for example, tempfile.mkdtemp) is not affected.
Root Cause
The root cause is inconsistent path handling between validation and directory creation. The containment check uses os.path.realpath or equivalent resolution, while makedirs operates on the unresolved joined path. This mismatch allows filesystem side effects along the traversal path that the validation step never inspects.
Attack Vector
An attacker delivers a crafted tar archive to a target application that extracts it with the tar or data filter on a POSIX system. The application must extract into a directory whose final path component is known or guessable. When extraction runs, empty attacker-controlled directories appear outside the destination while member data extracts normally inside it.
The vulnerability does not permit arbitrary file writes outside the destination. Impact is limited to empty directory creation, which can nonetheless enable denial of service, interference with lock directories, or preparation for follow-on attacks that rely on directory presence.
See the GitHub Pull Request for CPython and the Python Security Announcement Thread for technical details of the fix.
Detection Methods for CVE-2026-19672
Indicators of Compromise
- Unexpected empty directories appearing adjacent to or above known tar extraction destinations on POSIX hosts
- Log entries from applications invoking tarfile.TarFile.extractall or extract with filter='tar' or filter='data' on untrusted archives
- Tar archive members whose names contain .. sequences followed by the destination directory's final path component
Detection Strategies
- Inspect tar archives before extraction for member names containing .. traversal components using tarfile.TarFile.getmembers
- Monitor filesystem activity for mkdir syscalls executed by Python processes targeting paths outside expected extraction roots
- Audit application code for calls to tarfile extraction APIs that use non-randomized destination directories
Monitoring Recommendations
- Enable filesystem auditing (auditd on Linux) on directories that host archive extraction workflows
- Alert on Python process directory creation outside allow-listed extraction roots
- Track Python interpreter versions across the fleet to prioritize patching hosts running vulnerable releases
How to Mitigate CVE-2026-19672
Immediate Actions Required
- Apply the CPython patch referenced in pull request 156000 once released for your Python version
- Extract untrusted archives into randomized destination directories created with tempfile.mkdtemp to break the traversal precondition
- Audit application code that calls tarfile.extractall with the tar or data filter and review destination path selection
Patch Information
The fix aligns intermediate directory creation with the resolved-path containment check so that traversal components never touch the filesystem. Monitor the Python Security Announcement Thread for backport availability across supported Python branches.
Workarounds
- Extract archives into directories with randomized final path components so attackers cannot construct a member name that returns to the destination
- Pre-validate archive members and reject any name containing .. before invoking extraction
- Run extraction workflows in isolated containers or chroot environments to limit filesystem side effects
- On multi-tenant systems, restrict extraction processes with mandatory access controls such as SELinux or AppArmor
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
