tarfile tar and data extraction filters allow outside directory creation via exit-and-re-entry paths #155999

Activity

1. StanFromIreland

   self-assigned this

   on Aug 18, 2026
2. StanFromIreland

   added this to Tarfile issues 🗄️on Aug 18, 2026
3. StanFromIreland

   added

   type-securityA security issueA security issue

   stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directory

   3.11only security fixesonly security fixes

   3.10 (EOL)end of lifeend of life

   3.12only security fixesonly security fixes

   3.13only security fixesonly security fixes

   3.14bugs and security fixesbugs and security fixes

   3.15bugs and security fixesbugs and security fixes

   3.16new features, bugs and security fixesnew features, bugs and security fixes

   on Aug 18, 2026
4. StanFromIreland

   added 3 commits that reference this issue on Aug 19, 2026

   gh-155999: `tarfile`: handle a member that leaves the destination but…

   ...

   9768834

   [3.14] gh-155999: `tarfile`: handle a member that leaves the destinat…

   ...

   16dea1e

   [3.13] gh-155999: `tarfile`: handle a member that leaves the destinat…

   ...

   c7979f3
5. Yhg1s

   added a commit that references this issue on Aug 20, 2026

   [3.12] gh-155999: `tarfile`: handle a member that leaves the destinat…

   ...

   a5bfd96
6. hugovk

   added a commit that references this issue on Aug 31, 2026

   [3.15] gh-155999: `tarfile`: handle a member that leaves the destinat…

   ...

   038a091
7. hugovk

   removed

   3.12only security fixesonly security fixes

   3.13only security fixesonly security fixes

   3.14bugs and security fixesbugs and security fixes

   3.15bugs and security fixesbugs and security fixes

   3.16new features, bugs and security fixesnew features, bugs and security fixes

   on Aug 31, 2026
8. pablogsal

   added 2 commits that reference this issue on Oct 1, 2026

   [3.11] gh-155999: `tarfile`: handle a member that leaves the destinat…

   ...

   5aa989c

   [3.10] gh-155999: `tarfile`: handle a member that leaves the destinat…

   ...

   fc32a70
9. StanFromIreland

   closed this as completedon Oct 1, 2026
10. github-project-automation

    moved this to Done in Tarfile issues 🗄️on Oct 1, 2026
11. mcepl commented on Oct 7, 2026

    

    mcepl

    on Oct 7, 2026

    Contributor

    More actions

    Unfortunately, changelogs for all latest releases (except for 3.13.8) miss on the fact they fix this bug.
12. hugovk commented on Oct 7, 2026

    

    hugovk

    on Oct 7, 2026

    Member

    More actions

    This is in the changelog for 3.14:

    gh-155999: Fix the tarfile tar and data extraction filters creating directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given.

    https://docs.python.org/3.14/whatsnew/changelog.html#:~:text=gh%2D155999%3A%20Fix,name%20as%20given.

    And present in https://www.python.org/ftp/python/doc/3.14.8/python-3.14.8-docs-html.zip and https://www.python.org/ftp/python/3.14.8/Python-3.14.8.tar.xz.

    Also similarly for 3.10-3.13.

    Please can you point to exactly where it's missing?

    👍React with 👍1Reacted by Stan Ulbrych