CVE-2026-112937

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, ReadWriteLock can remove a randomized .filelock- private-hard-link directory during cleanup, allowing another local user with rename access in a non-sticky parent to observe a live name or forge a dead-owner sweep na...

CVE-2026-112934

filelock is a platform-independent file lock for Python. From 4.0.0 until 4.2.1, SoftReadWriteLock refreshes holder records by name, allowing another local user with rename access to the lock directory to replace a record with a named pipe and stall the lock, or under a permissive hard-link polic...

CVE-2026-112914

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock can restore a stale marker by name after moving it aside, allowing another local user with rename access in a non-sticky lock directory to swap in a symbolic link and, on a runtime that follows the link...

CVE-2019-6329

Local Privilege Escalation in HP Support Assistant A local privilege escalation bug in HP Support Assistant by abusing hard link Researcher: ManhNDd of Bkav Description In HP Support Assistant GUI , when you click Check for updates and messages , the service HP Support Solution Framework will run...

CVE-2026-104103

The Ludwig low-code AI framework (prior to version 0.17.8 ) is vulnerable to a path traversal flaw in the ludwig.datasets.archives.extract_archive() function. The root cause is the failure to validate symlink and hard-link members before calling TarFile.extractall(). An attacker can provide a cra...

EUVD-2026-101522

Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models. Prior to 0.17.8, ludwig.datasets.archives.extractarchive validated tar member names before calling TarFile.extractall but did not validate symlink members or hard-link members. A crafted archive could...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : GNU cpio vulnerabilities (USN-8704-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8704-1 advisory. It was discovered that cpio incorrectly sanitized hard-link targets when extracti...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: jfs: Truncating good inode pages when the hard link is 0 The value of the fileset for the inode copy from the disk by the reproducer is AGGRRESERVEDI. When the evict function is executed, its hard link number is 0, so its inode...

AlmaLinux 9.6 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc (ALMALINUX9.6:CLSA-2026:1789749056)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789749056 advisory. - In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link...

CentOS Linux 8 [TuxCare] Security Update: platform-python / platform-python-debug / platform-python-devel / etc (CENTOS-STREAM8:CLSA-2026:1789719542)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1789719542 advisory. - In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard...

Rocky Linux 9.6 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc (ALMALINUX9.6:CLSA-2026:1789749056)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789749056 advisory. - In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard li...

CentOS Linux 8.5 [TuxCare] Security Update: platform-python / platform-python-debug / platform-python-devel / etc (CENTOS8.5:CLSA-2026:1789719876)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1789719876 advisory. - In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link...

BIT-PYTHON-2026-82049 tarfile extraction filters allow file modification and content disclosure via hard link to symlink

In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose...

BIT-PYTHON-MIN-2026-82049 tarfile extraction filters allow file modification and content disclosure via hard link to symlink

In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose...

BIT-LIBPYTHON-2026-82049 tarfile extraction filters allow file modification and content disclosure via hard link to symlink

In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose...

python: Python tarfile module: File modification and content disclosure via crafted archives

A flaw was found in Python's tarfile module. This module's data and tar extraction filters are vulnerable to specially crafted archives containing a hard link to a symbolic link. An attacker could exploit this by providing a malicious archive. This could lead to unauthorized modification of file...

python: Python tarfile module: File modification and content disclosure via crafted archives

A flaw was found in Python's tarfile module. This module's data and tar extraction filters are vulnerable to specially crafted archives containing a hard link to a symbolic link. An attacker could exploit this by providing a malicious archive. This could lead to unauthorized modification of file...

python: Python tarfile module: File modification and content disclosure via crafted archives

A flaw was found in Python's tarfile module. This module's data and tar extraction filters are vulnerable to specially crafted archives containing a hard link to a symbolic link. An attacker could exploit this by providing a malicious archive. This could lead to unauthorized modification of file...

python: Python tarfile module: File modification and content disclosure via crafted archives

A flaw was found in Python's tarfile module. This module's data and tar extraction filters are vulnerable to specially crafted archives containing a hard link to a symbolic link. An attacker could exploit this by providing a malicious archive. This could lead to unauthorized modification of file...

SUSE CVE-2026-82049

In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose...