Cyber ·
CPython CVE-2026-114583: path traversal protection bypass in tarfile.tar_filter
CPython security advisory on a flaw that lets attackers bypass the path traversal protection in tarfile.tar_filter and write files outside the extraction directory.
On October 22, 2026, the oss-sec feed published an automatic translation of a CPython security advisory. CPython is the reference Python interpreter. The advisory, identified as CVE-2026-114583, describes a bypass of the path traversal protection in tarfile.tar_filter. According to the text, the flaw allows writing files outside the extraction directory. The original advisory was forwarded through the Python Security-announce list, authored by Stan Ulbrych, and the feed post is by Alan Coopersmith.
The received text is truncated. It does not state affected versions, a fixed version or further technical details, and this bulletin does not invent them. To verify these points, consult the original advisory on the official Python security list, searching by the CVE name, and compare it with the documentation for your environment's version.
The relevance for Brazilian organizations lies in workflows that extract archives received from third parties, such as attachments, document batches or packages sent by partners. In those cases, extraction can be an entry point. Rota Nacional does not fix or handle this vulnerability. If your workflow uses tarfile, update Python as the official advisory indicates and handle untrusted archives in an isolated environment.