VDB
RHSA-2026:54760
RHSA-2026:54760
PUBLISHED
CVSS 7.400000095367432 HIGH
A flaw was found in CPython's tarfile module. This vulnerability allows bypassing of extraction filters, enabling symlink traversal outside the intended extraction directory and potential modification of file metadata via malicious tar archives using TarFile.extractall() or TarFile.extract() with the filter="data" or filter="tar" parameters. This issue leads to potentially overwriting or modifying system files and metadata.
Risk Scores
CVSS 3.1
7.400000095367432
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/discovery/discovery-server-rhel9@sha256:33bb57a2ffa3b7be7bf730f6f1bc23c00bebba085925de708240f50f84614f41_arm64 as a component of Red Hat Discovery 2 | * |
| Red Hat | registry.redhat.io/discovery/discovery-ui-rhel9@sha256:39e32df84e26a6d882fd2f18d6a9981e5dd77ddfcd7fc18f1553d0ba726019a3_amd64 as a component of Red Hat Discovery 2 | * |
| Red Hat | registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8268709ddc6c9537cb5f0ab978b7afc507fdbf035723327e3f542b10eef2b25c_arm64 as a component of Red Hat Discovery 2 | * |
| Red Hat | registry.redhat.io/discovery/discovery-server-rhel9@sha256:43f1ad539e71187687fe816e256d2c016ab1048d9e56004e19e621b3518bde04_amd64 as a component of Red Hat Discovery 2 | * |
Timeline
- Aug 13, 2026 CVE Published
- Oct 1, 2026 CVE Updated
- Oct 1, 2026 Distribution Patch
- Oct 1, 2026 Distribution Patch
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:54760 advisory
- https://access.redhat.com/security/cve/CVE-2025-4330 advisory
- https://access.redhat.com/security/cve/CVE-2026-11940 advisory
- https://access.redhat.com/security/cve/CVE-2026-13676 advisory
- https://access.redhat.com/security/cve/CVE-2026-13757 advisory
- https://access.redhat.com/security/cve/CVE-2026-14164 advisory
- https://access.redhat.com/security/cve/CVE-2026-14257 advisory
- https://access.redhat.com/security/cve/CVE-2026-34993 advisory
- https://access.redhat.com/security/cve/CVE-2026-41989 advisory
- https://access.redhat.com/security/cve/CVE-2026-6477 advisory
- https://access.redhat.com/security/cve/CVE-2026-69152 advisory
- https://access.redhat.com/security/cve/CVE-2026-69153 advisory
- https://access.redhat.com/security/cve/CVE-2026-69243 advisory
- https://access.redhat.com/security/cve/CVE-2026-69244 advisory
- https://access.redhat.com/security/cve/CVE-2026-73086 advisory
- https://access.redhat.com/security/cve/CVE-2026-73088 advisory
- https://access.redhat.com/security/cve/CVE-2026-73089 advisory
- https://access.redhat.com/security/cve/CVE-2026-8643 advisory
- https://access.redhat.com/security/cve/CVE-2026-9595 advisory
- https://access.redhat.com/security/updates/classification/ advisory
…and 111 more