Critical Vulnerability in Python 3.9: Tarfile Extraction Filter Bypass
Summary
RLSA-2026:54268: Important: python3.9 security update. Affects python3.9 versions < 0:3.9.25-7.el9_8.3. Fixed in 0:3.9.25-7.el9_8.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.9 is an interpreted, interactive, object-oriented programming language known for its versatility and ease of use. It supports various system calls, libraries, and windowing systems, making it a popular choice for developers. However, a recent security vulnerability has been identified that allows an attacker to bypass the tarfile extraction filter, potentially leading to unauthorized access to the filesystem.
Vulnerability Detail
The vulnerability, identified as CVE-2026-11940, arises from a flaw in the tarfile module of CPython. This flaw allows attackers to escape the intended destination directory during tarfile extraction, which could lead to overwriting sensitive files or executing malicious scripts. The ramifications of this vulnerability are significant, as it could compromise the integrity and confidentiality of the system. The CVSS score for this vulnerability is 7.3, indicating a high level of risk.
How To Fix
Minimum fixed version
0:3.9.25-7.el9_8.3
This is the first release that contains the fix.
sudo dnf update python3.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid using the tarfile module for untrusted tar files until the package is updated. Additionally, ensure that your application has proper validation and sanitization of file paths to mitigate potential risks.
Conclusion
The vulnerability in Python 3.9, identified as CVE-2026-11940, poses a significant risk due to its ability to bypass tarfile extraction filters. It is crucial to update to the patched version to safeguard your systems. Utilize tools like Vulert to monitor for vulnerabilities in your applications.
See every vulnerability recorded for python3.9 →
FAQ
CVE-2026-11940 is a security vulnerability in Python 3.9 that allows attackers to bypass the tarfile extraction filter, leading to potential unauthorized access to the filesystem.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to unauthorized file access, overwriting of sensitive files, and execution of malicious scripts, compromising system integrity.
Run the command 'sudo dnf update python3.9' in your terminal to update to the patched version 3.9.25-7.el9_8.3 or later.
Yes, avoid using the tarfile module for untrusted tar files and ensure proper validation of file paths in your application.
Related vulnerabilities
Recent vulnerabilities recorded for python3.9.
