MediumFix available
pypy3, python3.13 and 1 more products — security advisory
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
- Products
- pypy3, python3.13, python3.14
- Affected versions
- 3.13.11-1, 3.13.12-1, 3.13.14-1, 3.13.5-2, 3.13.5-2+deb13u1, 3.13.5-2+deb13u2, 3.13.5-2+deb13u3, 3.13.5-2+deb13u4, 3.13.6-1, 3.13.7-1, 3.13.8-1, 3.13.9-1, 3.14.0-1, 3.14.0-2, 3.14.0-3, 3.14.0-4, 3.14.0-5, 3.14.0~a7-1, 3.14.0~b1-1, 3.14.0~b2-1, 3.14.0~b3-1, 3.14.0~b4-1, 3.14.0~rc1-1, 3.14.0~rc2-1, 3.14.0~rc3-1, 3.14.2-1, 3.14.3-1, 3.14.3-2, 3.14.3-3, 3.14.3-4, 3.14.3-5, 3.14.4-1, 3.14.4-2, 3.14.5-1, 3.14.5~rc1-1, 3.14.6-1, 7.3.19+dfsg-2, 7.3.20+dfsg-1, 7.3.20+dfsg-2, 7.3.20+dfsg-3, 7.3.20+dfsg-4, 7.3.21+dfsg-1, 7.3.21+dfsg-2, 7.3.21+dfsg-3, 7.3.21+dfsg-4, 7.3.22+dfsg-1, 7.3.23+dfsg-1, 7.3.23+dfsg-2, 8.0.0+dfsg-1, 8.0.1+dfsg-1
- Fixed versions
- 3.13.15-1, 3.13.5-2+deb13u5, 3.14.7-1, 8.0.0+dfsg-1
- CVEs
- CVE-2026-4360
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 13:34 UTC · Revision 2
Source evidence
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
osv:DEBIAN-CVE-2026-4360
pypy3
Fixed versions: Not specified
pypy3
Fixed versions: 8.0.0+dfsg-1
python3.13
Fixed versions: 3.13.5-2+deb13u5
python3.13
Fixed versions: 3.13.15-1
python3.14
Fixed versions: 3.14.7-1
Complete source record
{
"id": "bd90665314884b037cfaccea5e3cc7ae255ef256960cb6dd57646e06856774e9",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2026-4360",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2026-4360",
"summary": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.",
"evidence": "osv:DEBIAN-CVE-2026-4360",
"products": [
{
"name": {
"value": "pypy3",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "7.3.19+dfsg-2",
"evidence": "/affected/0/versions"
},
{
"value": "7.3.20+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "7.3.20+dfsg-2",
"evidence": "/affected/0/versions"
},
{
"value": "7.3.20+dfsg-3",
"evidence": "/affected/0/versions"
},
{
"value": "7.3.20+dfsg-4",
"evidence": "/affected/0/versions"
},
{
"value": "7.3.21+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "7.3.21+dfsg-2",
"evidence": "/affected/0/versions"
},
{
"value": "7.3.21+dfsg-3",
"evidence": "/affected/0/versions"
},
{
"value": "7.3.21+dfsg-4",
"evidence": "/affected/0/versions"
},
{
"value": "7.3.22+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "7.3.23+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "7.3.23+dfsg-2",
"evidence": "/affected/0/versions"
},
{
"value": "8.0.0+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "8.0.1+dfsg-1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "pypy3",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "8.0.0+dfsg-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": [
{
"value": "7.3.19+dfsg-2",
"evidence": "/affected/1/versions"
},
{
"value": "7.3.20+dfsg-1",
"evidence": "/affected/1/versions"
},
{
"value": "7.3.20+dfsg-2",
"evidence": "/affected/1/versions"
},
{
"value": "7.3.20+dfsg-3",
"evidence": "/affected/1/versions"
},
{
"value": "7.3.20+dfsg-4",
"evidence": "/affected/1/versions"
},
{
"value": "7.3.21+dfsg-1",
"evidence": "/affected/1/versions"
},
{
"value": "7.3.21+dfsg-2",
"evidence": "/affected/1/versions"
},
{
"value": "7.3.21+dfsg-3",
"evidence": "/affected/1/versions"
},
{
"value": "7.3.21+dfsg-4",
"evidence": "/affected/1/versions"
},
{
"value": "7.3.22+dfsg-1",
"evidence": "/affected/1/versions"
},
{
"value": "7.3.23+dfsg-1",
"evidence": "/affected/1/versions"
},
{
"value": "7.3.23+dfsg-2",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "python3.13",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.13.5-2+deb13u5",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": [
{
"value": "3.13.5-2",
"evidence": "/affected/2/versions"
},
{
"value": "3.13.5-2+deb13u1",
"evidence": "/affected/2/versions"
},
{
"value": "3.13.5-2+deb13u2",
"evidence": "/affected/2/versions"
},
{
"value": "3.13.5-2+deb13u3",
"evidence": "/affected/2/versions"
},
{
"value": "3.13.5-2+deb13u4",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "python3.13",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.13.15-1",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": [
{
"value": "3.13.11-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.13.12-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.13.14-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.13.5-2",
"evidence": "/affected/3/versions"
},
{
"value": "3.13.6-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.13.7-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.13.8-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.13.9-1",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "python3.14",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.14.7-1",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": [
{
"value": "3.14.0-1",
"evidence": "/affected/4/versions"
},
{
"value": "3.14.0-2",
"evidence": "/affected/4/versions"
},
{
"value": "3.14.0-3",
"evidence": "/affected/4/versions"
},
{
"value": "3.14.0-4",
"evidence": "/affected/4/versions"
},
{
"value": "3.14.0-5",
"evidence": "/affected/4/versions"
},
{
"value": "3.14.0~a7-1",
"evidence": "/affected/4/versions"
},
{
"value": "3.14.0~b1-1",
"evidence": "/affected/4/versions"
},
{
"value": "3.14.0~b2-1",
"evidence": "/affected/4/versions"
},
{
"value": "3.14.0~b3-1",
"evidence": "/affected/4/versions"
},
{
"value": "3.14.0~b4-1",
"evidence": "/affected/4/versions"
},
{
"value": "3.14.0~rc1-1",
"evidence": "/affected/4/versions"
},
{
"value": "3.14.0~rc2-1",
"evidence": "/affected/4/versions"
},
{
"value": "3.14.0~rc3-1",
"evidence": "/affected/4/versions"
},
{
"value": "3.14.2-1",
"evidence": "/affected/4/versions"
},
{
"value": "3.14.3-1",
"evidence": "/affected/4/versions"
},
{
"value": "3.14.3-2",
"evidence": "/affected/4/versions"
},
{
"value": "3.14.3-3",
"evidence": "/affected/4/versions"
},
{
"value": "3.14.3-4",
"evidence": "/affected/4/versions"
},
{
"value": "3.14.3-5",
"evidence": "/affected/4/versions"
},
{
"value": "3.14.4-1",
"evidence": "/affected/4/versions"
},
{
"value": "3.14.4-2",
"evidence": "/affected/4/versions"
},
{
"value": "3.14.5-1",
"evidence": "/affected/4/versions"
},
{
"value": "3.14.5~rc1-1",
"evidence": "/affected/4/versions"
},
{
"value": "3.14.6-1",
"evidence": "/affected/4/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "DEBIAN-CVE-2026-4360",
"aliases": [
"DEBIAN-CVE-2026-4360"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "pypy3",
"purl": "pkg:deb/debian/pypy3?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"7.3.19+dfsg-2",
"7.3.20+dfsg-1",
"7.3.20+dfsg-2",
"7.3.20+dfsg-3",
"7.3.20+dfsg-4",
"7.3.21+dfsg-1",
"7.3.21+dfsg-2",
"7.3.21+dfsg-3",
"7.3.21+dfsg-4",
"7.3.22+dfsg-1",
"7.3.23+dfsg-1",
"7.3.23+dfsg-2",
"8.0.0+dfsg-1",
"8.0.1+dfsg-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-4360.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.0+dfsg-1"
}
]
}
],
"package": {
"name": "pypy3",
"purl": "pkg:deb/debian/pypy3?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"7.3.19+dfsg-2",
"7.3.20+dfsg-1",
"7.3.20+dfsg-2",
"7.3.20+dfsg-3",
"7.3.20+dfsg-4",
"7.3.21+dfsg-1",
"7.3.21+dfsg-2",
"7.3.21+dfsg-3",
"7.3.21+dfsg-4",
"7.3.22+dfsg-1",
"7.3.23+dfsg-1",
"7.3.23+dfsg-2"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-4360.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.13.5-2+deb13u5"
}
]
}
],
"package": {
"name": "python3.13",
"purl": "pkg:deb/debian/python3.13?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"3.13.5-2",
"3.13.5-2+deb13u1",
"3.13.5-2+deb13u2",
"3.13.5-2+deb13u3",
"3.13.5-2+deb13u4"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-4360.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.13.15-1"
}
]
}
],
"package": {
"name": "python3.13",
"purl": "pkg:deb/debian/python3.13?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"3.13.11-1",
"3.13.12-1",
"3.13.14-1",
"3.13.5-2",
"3.13.6-1",
"3.13.7-1",
"3.13.8-1",
"3.13.9-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-4360.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.14.7-1"
}
]
}
],
"package": {
"name": "python3.14",
"purl": "pkg:deb/debian/python3.14?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"3.14.0-1",
"3.14.0-2",
"3.14.0-3",
"3.14.0-4",
"3.14.0-5",
"3.14.0~a7-1",
"3.14.0~b1-1",
"3.14.0~b2-1",
"3.14.0~b3-1",
"3.14.0~b4-1",
"3.14.0~rc1-1",
"3.14.0~rc2-1",
"3.14.0~rc3-1",
"3.14.2-1",
"3.14.3-1",
"3.14.3-2",
"3.14.3-3",
"3.14.3-4",
"3.14.3-5",
"3.14.4-1",
"3.14.4-2",
"3.14.5-1",
"3.14.5~rc1-1",
"3.14.6-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-4360.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-26T12:02:46.909753034Z",
"provider": "osv",
"upstream": [
"CVE-2026-4360"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2026-4360"
]
},
"related_cves": [
{
"value": "CVE-2026-4360",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 452559,
"published_at": "2026-06-30T15:16:57.193+00:00"
}