Critical Security Update for Python 3.12: Tarfile Extraction Filter Bypass Vulnerability
Summary
ALSA-2026:58902: Important: python3.12 security update. Affects python-unversioned-command versions < 3.12.14-1.el10_2. Fixed in 3.12.14-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used interpreted, interactive, object-oriented programming language known for its simplicity and versatility. It supports various modules, classes, exceptions, and dynamic data types, making it suitable for a range of applications from web development to data analysis. The recent vulnerability affects Python 3.12, specifically in the tarfile module, which is responsible for handling tar archive files. This vulnerability allows attackers to escape the intended extraction directory, potentially leading to unauthorized file access or system compromise.
Vulnerability Detail
The vulnerability identified as CVE-2026-11940 is a tarfile extraction filter bypass in CPython, which allows attackers to manipulate the extraction process of tar files. By exploiting this flaw, an attacker can extract files to arbitrary locations on the filesystem, bypassing the intended directory restrictions. This could lead to overwriting critical system files or executing malicious scripts, posing a significant security risk to systems using affected versions of Python.
How To Fix
Minimum fixed version
3.12.14-1.el10_2
This is the first release that contains the fix.
sudo dnf update python-unversioned-commandTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the tarfile module for untrusted tar files until the update is applied. Additionally, ensure that proper file permissions are set to limit access to sensitive directories.
Conclusion
The vulnerability CVE-2026-11940 poses a significant risk to users of Python 3.12 due to a flaw in the tarfile module that allows directory escape during file extraction. It is crucial to update to the patched version to mitigate this risk. Users should also consider using Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for python-unversioned-command →
FAQ
CVE-2026-11940 is a vulnerability in Python 3.12 that allows attackers to bypass directory restrictions during tarfile extraction, potentially leading to unauthorized file access.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized file access, potential overwriting of critical system files, and execution of malicious scripts, which can compromise system integrity.
Yes, a patch is available in the form of version 3.12.14-1.el10_2 for affected packages in AlmaLinux 10.
If immediate updating is not possible, avoid using the tarfile module for untrusted files and ensure that file permissions are appropriately set to limit access.
Related vulnerabilities
Recent vulnerabilities recorded for python-unversioned-command.
