CVE-2026-11940

/// Technical description

tarfile.extractall() with the 'data' or 'tar'

filter could be bypassed by a crafted archive where a hardlink

references a symlink stored at a deeper name than the hardlink itself. 

The extraction fallback validated the symlink at it's archived location

but recreated it at the hardlink's shallower

path, letting a relative

target the filter judged contained escape the destination directory. 

This allowed a malicious tar archive to create a symlink pointing

outside the destination, enabling out-of-destination file reads or

writes. This was an incomplete fix of CVE-2025-4330.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References