CVE-2026-4360: Python Tarfile Privilege Escalation Flaw

CVE-2026-4360 Overview

CVE-2026-4360 affects the Python standard library tarfile module. The TarFile.extract() function fails to propagate the filter parameter when extracting hardlink members. As a result, an application extracting content from untrusted tar archives may write files with unexpected user identifier (UID) or group identifier (GID) values, even when the caller explicitly passes filter='data'. The flaw is categorized under [CWE-281] Improper Preservation of Permissions. The vulnerability was disclosed through the CPython project and addressed in Python 3.14 and 3.15 branches.

Critical Impact

Applications relying on filter='data' to sanitize untrusted tar archives may still extract hardlinks that retain attacker-controlled ownership metadata, undermining the safety guarantees of the extraction filter.

Affected Products

• CPython tarfile module in Python 3.14 branch prior to the fix
• CPython tarfile module in Python 3.15 branch prior to the fix
• Applications and tooling that call TarFile.extract() with filter='data' on untrusted archives

Discovery Timeline

• 2026-06-30 - CVE-2026-4360 published to NVD
• 2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-4360

Vulnerability Analysis

The tarfile module implements extraction filters to mitigate unsafe archive contents. Callers pass filter='data' to enforce safe defaults, including neutralizing owner and permission metadata. The TarFile.extract() code path invokes _get_extract_tarinfo() to obtain a filtered TarInfo object, then calls _extract_one() to write the member to disk. The filter_function argument was not forwarded to _extract_one(), so when the member is a hardlink, the filter is not reapplied during hardlink handling. This produces extracted entries that retain UID and GID values from the archive rather than the sanitized values the filter would have supplied.

Root Cause

The defect stems from a missing keyword argument in the internal dispatch inside Lib/tarfile.py. _extract_one() accepts a filter_function parameter, but the extract() method did not pass it, causing hardlink extraction to bypass filter-driven ownership sanitization.

Attack Vector

An attacker crafts a tar archive containing hardlink entries with attacker-selected UID and GID values. A victim application invokes TarFile.extract() with filter='data', expecting safe extraction. The hardlink entry is written with the attacker-supplied ownership metadata. Exploitation requires the victim to process untrusted archives and, per the reported vector, elevated privileges to influence resulting ownership on disk. Impact is limited to integrity of file ownership metadata; there is no direct confidentiality or availability impact.

        tarinfo, unfiltered = self._get_extract_tarinfo(
            member, filter_function, path)
        if tarinfo is not None:
-            self._extract_one(tarinfo, path, set_attrs, numeric_owner)
+            self._extract_one(tarinfo, path, set_attrs, numeric_owner,
+                              filter_function=filter_function)

    def _get_extract_tarinfo(self, member, filter_function, path):
        """Get (filtered, unfiltered) TarInfos from *member*

Source: CPython commit 5e0ef3f. The patch forwards filter_function to _extract_one() so hardlink extraction honors the caller-supplied filter.

Detection Methods for CVE-2026-4360

Indicators of Compromise

• Files on disk with UID or GID values that do not match the extracting user account, produced after tar extraction by a Python-based tool.
• Presence of hardlink entries in received archives referencing sensitive system paths or system-owned UIDs (0, low-numbered service accounts).
• Python runtime versions on the 3.14 or 3.15 branch predating the merged fix (commits 5e0ef3f, 7b57e8d, 7ccdbab, eee3ddf).

Detection Strategies

• Inventory Python interpreters across build servers, container images, and developer workstations and compare against patched Python releases.
• Static analysis of application code for calls to tarfile.TarFile.extract() and tarfile.open().extract() where the input source is untrusted.
• Runtime file integrity monitoring on directories used as extraction targets, alerting when new files appear with unexpected ownership.

Monitoring Recommendations

• Log the source, size, and member metadata of every tar archive processed by production services.
• Alert on filesystem events that create files with UID or GID mismatches relative to the invoking process context.
• Track Python package and interpreter versions through software bill of materials (SBOM) tooling to identify unpatched dependencies.

How to Mitigate CVE-2026-4360

Immediate Actions Required

• Upgrade Python to a release containing the tarfile fix on the 3.14 or 3.15 branch as published in the Python Security Announcement.
• Audit application code that consumes untrusted tar archives and confirm callers use filter='data' on patched runtimes.
• Rebuild container images and CI runners that ship a bundled Python interpreter so downstream consumers pick up the corrected tarfile.py.

Patch Information

The fix is tracked in GitHub issue gh-151987 and merged via pull request 151988. Branch-specific patches are available in commits 5e0ef3f (3.14), 7b57e8d (3.15), 7ccdbab (main), and a follow-up eee3ddf.

Workarounds

• Reject or strip hardlink members before invoking extract() by iterating TarFile.getmembers() and skipping entries where tarinfo.islnk() returns true.
• Extract archives inside a non-privileged sandbox or dedicated user namespace to constrain the effect of unexpected UID and GID values.
• Post-process extracted directories with chown to normalize ownership to the intended service account.

# Verify installed Python version includes the tarfile fix
python3 --version
python3 -c "import tarfile, inspect; print(inspect.getsourcefile(tarfile))"

# Normalize ownership on an extraction target as a defensive workaround
chown -R appuser:appgroup /path/to/extracted