gh-155999: In `tarfile`, handle a member that leaves the destination and comes back by StanFromIreland · Pull Request #156000 · python/cpython · GitHub

Issue: tarfile tar and data extraction filters allow outside directory creation via exit-and-re-entry paths #155999

Documentation build overview

📚 cpython-previews | 🛠️ Build #34125170 | 📁 Comparing 40c0c7c against main (60dff5a)

3 files changed
± library/asyncio-task.html
± library/tarfile.html
± whatsnew/changelog.html

Thanks @StanFromIreland for the PR 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11, 3.12, 3.13, 3.14, 3.15.
🐍🍒⛏🤖

GH-156040 is a backport of this pull request to the 3.15 branch.

GH-156041 is a backport of this pull request to the 3.14 branch.

GH-156042 is a backport of this pull request to the 3.13 branch.

GH-156043 is a backport of this pull request to the 3.12 branch.

Sorry, @StanFromIreland, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 97688346ada2df3e5b9c279348862c3d64ab0823 3.10

GH-156044 is a backport of this pull request to the 3.11 branch.

GH-156046 is a backport of this pull request to the 3.10 branch.

…ion but comes back (GH-156000) (#156041) (cherry picked from commit 9768834) Co-authored-by: Stan Ulbrych <stan@python.org>

…ion but comes back (GH-156000) (#156042) (cherry picked from commit 9768834) Co-authored-by: Stan Ulbrych <stan@python.org>

…ion but comes back (GH-156000) (#156043) gh-155999: `tarfile`: handle a member that leaves the destination but comes back (GH-156000) (cherry picked from commit 9768834) Co-authored-by: Stan Ulbrych <stan@python.org>

…ion but comes back (GH-156000) (#156040) gh-155999: `tarfile`: handle a member that leaves the destination but comes back (GH-156000) (cherry picked from commit 9768834) Co-authored-by: Stan Ulbrych <stan@python.org>

https://build.opensuse.org/request/show/1378363 by user mcepl + anag_factory - Restore back macros.python3, we need it. - CVE-2026-19672: in tarfile, handle a member that leaves the destination and comes back (bsc#1276227, gh#python/cpython#156000) CVE-2026-19672-tarfile-outside-dirs.patch CVE-2026-17084: Don't consider Unicode codepoint attributes outside RFC 3454 (bsc#1276226) CVE-2026-17084-unicode-rfc3454.patch - Add sphinx9-runtime-node.patch fixing documentation build with Sphinx 9 by importing the extension's Node type at runtime. - Restore the self-contained structure of the python313 package in openSUSE Factory: * the package has started to rely on the separate virtual `python3` package for the generic interpreter entry points and for the `python3*` Provides (bsc#1258364). That structure is meant for the SUSE Linux family of

https://build.opensuse.org/request/show/1379535 by user mcepl + anag_factory - CVE-2026-15310: bound zipfile decompression for bzip2/LZMA/Zstandard (bsc#1277111, gh#python/cpython#156002) CVE-2026-15310-bound-zipfile-decompression.patch CVE-2026-15310-keep-through-3rd-party-decomp.patch - CVE-2026-19672: in tarfile, handle a member that leaves the destination and comes back (bsc#1276227, gh#python/cpython#156000) CVE-2026-19672-tarfile-outside-dirs.patch - CVE-2026-17084: Don't consider Unicode codepoint attributes outside RFC 3454 (bsc#1276226) CVE-2026-17084-stringprep-rfc3454.patch

https://build.opensuse.org/request/show/1379773 by user mcepl + dimstar_suse - CVE-2026-15310: bound zipfile decompression for bzip2/LZMA (bsc#1277111, gh#python/cpython#156002) CVE-2026-15310-bound-zipfile-decompression.patch - CVE-2026-19672: in tarfile, handle a member that leaves the destination and comes back (bsc#1276227, gh#python/cpython#156000) CVE-2026-19672-tarfile-outside-dirs.patch CVE-2026-17084: Don't consider Unicode codepoint attributes outside RFC 3454 (bsc#1276226) CVE-2026-17084-stringprep-rfc3454.patch - CVE-2026-15806: Scope HTTPPasswordMgr credentials by URL scheme (bsc#1276223) * Add CVE-2026-15806-HTTPPasswordMgr-scheme.patch

…ion but comes back (GH-156000) (#156044) gh-155999: `tarfile`: handle a member that leaves the destination but comes back (GH-156000) (cherry picked from commit 9768834) Co-authored-by: Stan Ulbrych <stan@python.org>

…ion but comes back (GH-156000) (#156046) (cherry picked from commit 9768834) Co-authored-by: Pablo Galindo Salgado <Pablogsal@gmail.com>

https://build.opensuse.org/request/show/1381747 by user mcepl + anag_factory - CVE-2026-15310: bound zipfile decompression for bzip2/LZMA/Zstandard (bsc#1277111, gh#python/cpython#156002) CVE-2026-15310-bound-zipfile-decompression.patch - CVE-2026-19672: in tarfile, handle a member that leaves the destination and comes back (bsc#1276227, gh#python/cpython#156000) CVE-2026-19672-tarfile-outside-dirs.patch - CVE-2026-17084: Don't consider Unicode codepoint attributes outside RFC 3454 (bsc#1276226) * Add CVE-2026-17084-stringprep-rfc3454.patch - CVE-2026-15806: Scope HTTPPasswordMgr credentials by URL scheme (bsc#1276223) * Add CVE-2026-15806-HTTPPasswordMgr-scheme.patch

https://build.opensuse.org/request/show/1381748 by user mcepl + anag_factory - CVE-2026-15310: bound zipfile decompression for bzip2/LZMA/Zstandard (bsc#1277111, gh#python/cpython#156002) CVE-2026-15310-bound-zipfile-decompression.patch - CVE-2026-19672: in tarfile, handle a member that leaves the destination and comes back (bsc#1276227, gh#python/cpython#156000) CVE-2026-19672-tarfile-outside-dirs.patch - CVE-2026-17084: Don't consider Unicode codepoint attributes outside RFC 3454 (bsc#1276226) CVE-2026-17084-stringprep-RFC-3454.patch - CVE-2026-15806: scope HTTPPasswordMgr credentials by URL scheme (bsc#1276223) CVE-2026-15806-http-passwordmgr-scheme.patch

StanFromIreland added 3 commits August 13, 2026 13:12

Handle a member that leaves the destination and comes back

92cfb2f

Improve documentation

03116fc

Add issue number

b2e29a9

StanFromIreland requested a review from encukou August 18, 2026 11:25

StanFromIreland requested a review from ethanfurman as a code owner August 18, 2026 11:25

bedevere-app Bot mentioned this pull request Aug 18, 2026

tarfile tar and data extraction filters allow outside directory creation via exit-and-re-entry paths #155999

Closed

bedevere-app Bot added the awaiting core review label Aug 18, 2026

ethanfurman reviewed Aug 18, 2026

View reviewed changes

Comment thread Lib/test/test_tarfile.py

ethanfurman approved these changes Aug 18, 2026

View reviewed changes

Comment thread Lib/test/test_tarfile.py

bedevere-app Bot added awaiting merge and removed awaiting core review labels Aug 18, 2026

Drop test failing on Windows, it wasn't doing much anyway

40c0c7c

StanFromIreland added needs backport to 3.10 needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 only security fixes needs backport to 3.14 bugs and security fixes needs backport to 3.15 bugs and security fixes labels Aug 18, 2026

encukou approved these changes Aug 19, 2026

View reviewed changes

StanFromIreland merged commit 9768834 into python:main Aug 19, 2026
66 checks passed

StanFromIreland deleted the tarfile-around-the-world-escape branch August 19, 2026 08:52

bedevere-app Bot removed the awaiting merge label Aug 19, 2026

bedevere-app Bot removed the needs backport to 3.15 bugs and security fixes label Aug 19, 2026

bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label Aug 19, 2026

bedevere-app Bot removed the needs backport to 3.13 only security fixes label Aug 19, 2026

bedevere-app Bot removed the needs backport to 3.12 only security fixes label Aug 19, 2026

miss-islington-app Bot assigned StanFromIreland Aug 19, 2026

bedevere-app Bot removed the needs backport to 3.11 only security fixes label Aug 19, 2026

bedevere-app Bot removed the needs backport to 3.10 label Aug 19, 2026

StanFromIreland added a commit that referenced this pull request Aug 19, 2026

[3.14] gh-155999 : tarfile : handle a member that leaves the destinat…

16dea1e

…ion but comes back (GH-156000) (#156041) (cherry picked from commit 9768834) Co-authored-by: Stan Ulbrych <stan@python.org>

StanFromIreland added a commit that referenced this pull request Aug 19, 2026

[3.13] gh-155999 : tarfile : handle a member that leaves the destinat…

c7979f3

…ion but comes back (GH-156000) (#156042) (cherry picked from commit 9768834) Co-authored-by: Stan Ulbrych <stan@python.org>

LearningCircuit mentioned this pull request Aug 27, 2026

fix(release-gate): bump python base digest and suppress unfixable CPython CVE batch LearningCircuit/local-deep-research#5889

Merged

ai-collaboration-app Bot mentioned this pull request Sep 8, 2026

[stackstate-agent] Dev scan 34027081656: bump x/crypto to 0.56.0 and grpc to 1.83.1; krb5 and python rows need a human VEX or exception decision StackVista/stackstate-agent#509

Open

pablogsal added a commit that referenced this pull request Oct 1, 2026

[3.10] gh-155999 : tarfile : handle a member that leaves the destinat…

fc32a70

…ion but comes back (GH-156000) (#156046) (cherry picked from commit 9768834) Co-authored-by: Pablo Galindo Salgado <Pablogsal@gmail.com>

github-actions Bot mentioned this pull request Oct 5, 2026

Update ghcr.io/qbittorrent/docker-qbittorrent-nox Docker tag to v5.2.4-lt2-1 claytono/infra#3095

Merged

1 task

gh-155999: In `tarfile`, handle a member that leaves the destination and comes back by StanFromIreland · Pull Request #156000 · python/cpython · GitHub

Repository navigation

gh-155999: In tarfile, handle a member that leaves the destination and comes back - #156000

gh-155999: In tarfile, handle a member that leaves the destination and comes back#156000
StanFromIreland merged 4 commits into
python:mainfrom
StanFromIreland:tarfile-around-the-world-escape

StanFromIreland commented Aug 18, 2026 •
edited by bedevere-app Bot
Loading

Uh oh!

Uh oh!

read-the-docs-community Bot commented Aug 18, 2026 •
edited
Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

miss-islington-app Bot commented Aug 19, 2026

Uh oh!

bedevere-app Bot commented Aug 19, 2026

Uh oh!

bedevere-app Bot commented Aug 19, 2026

Uh oh!

bedevere-app Bot commented Aug 19, 2026

Uh oh!

bedevere-app Bot commented Aug 19, 2026

Uh oh!

miss-islington-app Bot commented Aug 19, 2026

Uh oh!

bedevere-app Bot commented Aug 19, 2026

Uh oh!

bedevere-app Bot commented Aug 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

gh-155999: In `tarfile`, handle a member that leaves the destination and comes back by StanFromIreland · Pull Request #156000 · python/cpython · GitHub

Repository navigation

gh-155999: In tarfile, handle a member that leaves the destination and comes back - #156000

gh-155999: In tarfile, handle a member that leaves the destination and comes back#156000StanFromIreland merged 4 commits intopython:mainpython/cpython:mainfrom StanFromIreland:tarfile-around-the-world-escapeStanFromIreland/cpython:tarfile-around-the-world-escapeCopy head branch name to clipboard

Conversation

StanFromIreland commented Aug 18, 2026 • edited by bedevere-app Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

read-the-docs-community Bot commented Aug 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Documentation build overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

miss-islington-app Bot commented Aug 19, 2026

Uh oh!

bedevere-app Bot commented Aug 19, 2026

Uh oh!

bedevere-app Bot commented Aug 19, 2026

Uh oh!

bedevere-app Bot commented Aug 19, 2026

Uh oh!

bedevere-app Bot commented Aug 19, 2026

Uh oh!

miss-islington-app Bot commented Aug 19, 2026

Uh oh!

bedevere-app Bot commented Aug 19, 2026

Uh oh!

bedevere-app Bot commented Aug 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

gh-155999: In tarfile, handle a member that leaves the destination and comes back#156000
StanFromIreland merged 4 commits into
python:mainfrom
StanFromIreland:tarfile-around-the-world-escape

StanFromIreland commented Aug 18, 2026 •
edited by bedevere-app Bot
Loading

read-the-docs-community Bot commented Aug 18, 2026 •
edited
Loading