Skip to content

CVE-2026-7774 on CTRL-OS 26.05

Aliases: CVE-2026-7774

Packages: python313

Status: Plausible, Resolved

Advisory Information

tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process.

Updates

2026-07-21 16:44 CEST

Metadata changes:

  • Status for package python313: “Resolved” (fff38d56fb8e15a140da141149c596766b838d0b)

(Amended on: 2026-07-21 16:45 CEST)

2026-07-21 16:44 CEST

Metadata changes:

  • Status for package python314: “Resolved” (b907b8ba5e335b35aed7b8b2d2f2058d8f10e055)

(Amended on: 2026-07-21 16:45 CEST)

2026-07-21 16:44 CEST

Metadata changes:

  • Status for package python315: “Resolved” (efbecb049efee52f0b276729d22033a6e2c7265b)

(Amended on: 2026-07-21 16:45 CEST)

2026-07-21 16:43 CEST

Metadata changes:

  • Status for package python311: “Plausible”
  • Status for package python312: “Plausible”
  • Status for package python313: “Plausible”
  • Status for package python314: “Plausible”
  • Status for package python315: “Plausible”

2026-06-11 16:57 CEST

Metadata changes:

  • Status for package python311: “New”
  • Status for package python312: “New”
  • Status for package python313: “New”
  • Status for package python314: “New”
  • Status for package python315: “New”