Security Update for Python 3.9: Tarfile Extraction Filter Bypass Vulnerability
Summary
ALSA-2026:54268: Important: python3.9 security update. Affects python-unversioned-command versions < 3.9.25-7.el9_8.3. Fixed in 3.9.25-7.el9_8.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used interpreted programming language known for its versatility and ease of use. It supports various programming paradigms and provides extensive libraries and frameworks. The affected package, Python 3.9, is part of the AlmaLinux ecosystem and is utilized for developing applications, scripting, and automation. This version has been identified to have a security vulnerability that could potentially allow unauthorized access to file system paths during tarfile extraction.
Vulnerability Detail
The vulnerability, identified as CVE-2026-11940, is a tarfile extraction filter bypass issue in CPython. It allows attackers to escape the intended destination directory when extracting tar files, which could lead to unauthorized file access or overwriting of critical files. This vulnerability arises from improper validation of file paths during the extraction process, making it crucial for users to apply the necessary updates to mitigate risks.
How To Fix
Minimum fixed version
3.9.25-7.el9_8.3
This is the first release that contains the fix.
sudo dnf update python-unversioned-commandTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid extracting untrusted tar files or ensure that they are extracted in a controlled environment where file access can be monitored. However, this is not a permanent solution and updating the package is strongly recommended.
Conclusion
The vulnerability in Python 3.9, identified as CVE-2026-11940, poses a significant risk due to its potential for unauthorized file access. Users are strongly advised to update their Python packages to the patched version to mitigate this risk. Regular monitoring and prompt updates are essential for maintaining security in software applications.
See every vulnerability recorded for python-unversioned-command →
FAQ
CVE-2026-11940 is a security vulnerability in Python 3.9 that allows a tarfile extraction filter bypass, potentially leading to unauthorized file access.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, avoid extracting untrusted tar files and monitor your environment for any suspicious activity.
Failing to address this vulnerability could lead to unauthorized access to sensitive files, data breaches, or system compromise.
More information can be found on the CVE page associated with CVE-2026-11940, which provides detailed insights into the vulnerability and its impact.
Related vulnerabilities
Recent vulnerabilities recorded for python-unversioned-command.
