Critical Security Flaw in Python 3.14: Tarfile Extraction Filter Bypass
Summary
ALSA-2026:58928: Important: python3.14 security update. Affects python3.14 versions < 3.14.7-2.el10_2. Fixed in 3.14.7-2.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.14 is an interpreted, interactive, object-oriented programming language widely used for various applications, from web development to data analysis. It features modules, classes, exceptions, and dynamic data types, making it versatile and powerful. However, a recent security vulnerability has been identified that affects the tarfile module, allowing unauthorized directory access during file extraction.
Vulnerability Detail
The vulnerability, identified as CVE-2026-11940, is a tarfile extraction filter bypass that permits attackers to escape the intended destination directory when extracting files. This flaw could lead to unauthorized file access and potential system compromise, as malicious actors may exploit this vulnerability to overwrite critical files or execute arbitrary code.
How To Fix
Minimum fixed version
3.14.7-2.el10_2
This is the first release that contains the fix.
sudo dnf update python3.14Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the tarfile module for extracting files from untrusted sources until the package is updated. Consider using alternative libraries or methods for file extraction that do not exhibit this vulnerability.
Conclusion
The vulnerability in Python 3.14 poses significant risks due to the tarfile extraction filter bypass. It is crucial to update to the patched version to mitigate these risks. Users should remain vigilant and consider using alternative methods for file extraction until the update is applied.
See every vulnerability recorded for python3.14 →
FAQ
CVE-2026-11940 is a security vulnerability in Python 3.14 that allows a tarfile extraction filter bypass, enabling attackers to escape the destination directory.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The risks include unauthorized file access, potential overwriting of critical files, and the execution of arbitrary code, which could lead to system compromise.
Yes, a patch is available in version 3.14.7-2.el10_2 of Python 3.14. It is recommended to update to this version.
If you cannot update immediately, avoid using the tarfile module for extracting files from untrusted sources as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for python3.14.
