CVE-2026-87910

🗓️ 14 Sep 2026 00:00:00Reported by ubuntu.comType

ubuntucve🔗 ubuntu.com👁 3 Views

tarfile ignores a filter result when extracting links on non-link systems, not skipping the member.

Reporter	Title	Published	Views	Family All 14
Circl	CVE-2026-87910	11 Sep 202618:10	–	circl
CVE	CVE-2026-87910	11 Sep 202617:27	–	cve
Cvelist	CVE-2026-87910 tarfile hardlink fallback ignores custom extraction filter rejection via None	11 Sep 202617:27	–	cvelist
Debian CVE	CVE-2026-87910	11 Sep 202617:27	–	debiancve
EUVD	EUVD-2026-76162	11 Sep 202617:27	–	euvd
NVD	CVE-2026-87910	11 Sep 202618:16	–	nvd
OSV	DEBIAN-CVE-2026-87910	11 Sep 202618:16	–	osv
OSV	ECHO-AF90-15A4-1B7E	12 Sep 202613:00	–	osv
OSV	PSF-2026-40	11 Sep 202617:27	–	osv
OSV	UBUNTU-CVE-2026-87910	14 Sep 202600:00	–	osv

OS	OS Version	Architecture	Package	Package Version	Filename
Ubuntu	20.04	all	pypy3	0	pypy3_0_all.deb
Ubuntu	22.04	all	pypy3	0	pypy3_0_all.deb
Ubuntu	24.04	all	pypy3	0	pypy3_0_all.deb
Ubuntu	26.04	all	pypy3	0	pypy3_0_all.deb
Ubuntu	14.04	all	python2.7	0	python2.7_0_all.deb
Ubuntu	16.04	all	python2.7	0	python2.7_0_all.deb
Ubuntu	18.04	all	python2.7	0	python2.7_0_all.deb
Ubuntu	20.04	all	python2.7	0	python2.7_0_all.deb
Ubuntu	22.04	all	python2.7	0	python2.7_0_all.deb
Ubuntu	14.04	all	python3.4	0	python3.4_0_all.deb

Source	Link
cve	www.cve.org/CVERecord
mail	www.mail.python.org/archives/list/[email protected]/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/
github	www.github.com/python/cpython/issues/157265
github	www.github.com/python/cpython/pull/157266
github	www.github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2%20(main)
github	www.github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b
github	www.github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2
openwall	www.openwall.com/lists/oss-security/2026/09/11/8

14 Sep 2026 09:43Current

CVSS 45.7

EPSS0.00423

SSVC

tarfile filter bypass link extraction return value ignored Unix systems