Key points
- CVE-2026-114583 affects the tarfile module in Python
- The flaw allows writing files outside the extraction directory
- No fix has been confirmed yet according to the advisory
The Python programming language contains a security flaw in its tarfile module that allows path traversal attacks. This issue is tracked as CVE-2026-114583. According to an advisory posted to the oss-security mailing list on October 22, 2026, the vulnerability bypasses existing safety filters. The flaw permits malicious actors to write files outside the designated extraction directory. This behavior can lead to unauthorized file placement on systems running affected Python versions.
In plain English
When Python extracts files from a tar archive, it uses a filter to keep files within a safe folder. This filter is supposed to block attempts to escape that folder. The new flaw bypasses this protection. Attackers can craft a tar file that tricks the filter. The system then writes the file to a different location than intended. This allows data to be placed anywhere the Python process has permission to write.
The background
Stan Ulbrych posted the security announcement via the Security-announce list. The message was forwarded by Alan Coopersmith to the oss-security mailing list. The advisory explicitly names the component as tarfile.tar_filter. It describes the issue as a path traversal bypass. The date of the original message was October 22, 2026. The source material does not specify which Python versions are vulnerable or if a patch is ready.
What changes now
Teams using Python must assume their tarfile operations are at risk. Any process that extracts untrusted tar archives is potentially affected. The vulnerability allows writing outside the extraction directory. This means sensitive system files could be overwritten or new malicious files could be created. Users should review their code for uses of the tarfile module. They must determine if they process archives from untrusted sources.
Who needs to act first
Teams usually prioritize systems that process external archives first. Check whether your applications extract tar files from users or the internet. Isolate these services from critical system directories. Use strict file permissions to limit where Python can write. Test any mitigation in a sandbox before applying it broadly. Back up important data before making changes. Monitor logs for unexpected file creation. Reduce exposure by disabling archive extraction features if they are not essential.
Background: Path traversal vulnerabilities
Prevent path traversal by enforcing strict allowlists for permitted file names, using chroots to isolate processes, and canonicalizing paths to resolve symbolic links. Avoid relying solely on input filtering, as attackers can encode slashes or use null bytes to bypass basic checks.
Read the full guide: Stop Path Traversal Attacks: Defense Strategies That Actually Work
What to do and how to stay safe: Python
- Audit your Python applications for uses of the tarfile module.
- Verify if your code extracts archives from untrusted or user-supplied sources.
- Implement strict directory permissions to limit file write capabilities.
- Monitor system logs for unexpected file creation or modification events.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-114583?
It is a path traversal bypass in Python's tarfile module that allows writing outside the extraction directory.
Is there a patch available?
No fix has been confirmed yet according to the provided source material.
Which Python versions are affected?
The source material does not specify which Python versions are affected by this vulnerability.
