Critical Security Update for Python 3.12: Tarfile Extraction Filter Bypass Vulnerability
Summary
ALSA-2026:58971: Important: python3.12 security update. Affects python3.12 versions < 3.12.14-1.el8_10. Fixed in 3.12.14-1.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.12 is an interpreted, interactive, object-oriented programming language that supports various system calls and libraries. It is widely used for web development, data analysis, artificial intelligence, and more. The recent vulnerability identified in Python 3.12 relates to the tarfile module, which is responsible for handling tar archive files. This vulnerability can lead to unauthorized file extraction outside the intended directory, posing significant security risks.
Vulnerability Detail
The vulnerability, identified as CVE-2026-11940, is a tarfile extraction filter bypass that allows attackers to escape the destination directory during the extraction process. This could enable unauthorized access to sensitive files on the system, leading to potential data breaches or system compromise. The issue arises from insufficient validation of file paths during the extraction process, making it critical for users to address this vulnerability promptly.
How To Fix
Minimum fixed version
3.12.14-1.el8_10
This is the first release that contains the fix.
sudo dnf update python3.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the tarfile module for untrusted archives until the update is applied. Additionally, ensure that proper file permissions are set to limit access to sensitive directories.
Conclusion
The vulnerability in Python 3.12 poses significant security risks due to the tarfile extraction filter bypass. Users are strongly advised to update to the patched version 3.12.14-1.el8_10 to protect their systems from potential exploitation. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for python3.12 →
FAQ
CVE-2026-11940 is a vulnerability in Python 3.12 that allows for a tarfile extraction filter bypass, potentially leading to unauthorized file access.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to sensitive files, potential data breaches, and system compromise.
Yes, a patch is available in version 3.12.14-1.el8_10 of Python 3.12. Users should update to this version to mitigate the risk.
If immediate updating is not possible, avoid using the tarfile module for untrusted archives and ensure proper file permissions are in place.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12.
