python/python CVE-2026-114583: medium 6.9, EPSS 0.26%
tar filter allows writing outside destination via empty-named symlink
Action: The 3.16.x fix (3.16.0) is not released yet.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.16.0 | - |
Fixed versions
| 3.16.0 |
Sources
- python-runtime: PSF-2026-45
- https://www.cve.org/CVERecord?id=CVE-2026-114583
CVE-2026-114583 · published · modified · JSON