CVE-2026-87910

Executive Summary

CVE-2026-87910 is a path traversal/arbitration flaw (CWE-22) in the Python tarfile module's link extraction fallback logic. On systems that do not support symbolic or hard links (e.g., certain constrained filesystems or platforms), tarfile falls back to extracting the link's target member from the archive, and in doing so, it invokes the configured filter function twice — once for the extracted member and once with name set to the location of the link — but ignores the return value of one of those calls. As a result, a maliciously crafted tar archive may cause a member to be extracted even when the filter function returns None (i.e., signals "skip this member"), enabling archive-based traversal or unauthorized file writes on the extracting host. Any Python application that calls tarfile.extractall() or tarfile.extract() on untrusted archives with a filter function and runs on a link-unsupported system is potentially affected; the impact is filesystem integrity/confidentiality compromise on the extraction target.

Technical Analysis

The vulnerability resides in the interaction between two tarfile features: (1) the link-extraction fallback path, and (2) the extraction filter mechanism. When tarfile processes an archive member that is a link (symbolic or hard link), it normally creates the link on disk. On systems that do not support links, extraction of the link itself is not possible, so tarfile falls back to extracting the target member that the link points to. This fallback is the vulnerable code path.

The filter function is a user-supplied or built-in callable (e.g., tarfile.data_filter, tarfile.tar_filter, or a custom callable) passed to extract()/extractall() via the filter parameter. Its contract is to return a TarInfo object to permit extraction, or None to skip the member. When the fallback path executes, the implementation calls the filter twice:

1. Once for the member being extracted (the link's target/member object).
2. Once with name set to the location of the link (the link path itself).

Only one of these return values is honored. The other return value — specifically the one where name is set to the link location — is ignored. Consequently, if the filter returns None for that call (indicating the member should be skipped), the code does not act on that decision and proceeds to extract the member anyway.

From a security perspective, the filter function is precisely the control that is supposed to enforce path-traversal safety (blocking absolute paths, .. components, and writes outside the extraction root). When its None return is discarded, a crafted archive can bypass the filter and cause a member to be written to a location that the filter would otherwise have rejected. This is the direct mechanism underlying the CWE-22 classification. The result is an archive-extraction path traversal on link-unsupported systems.

Key characteristics:

• Attack surface: any application or service that extracts untrusted tar archives with a filter function on a link-unsupported system.
• Preconditions: the target filesystem/platform must not support links (otherwise the fallback is not taken); the archive must contain a link entry pointing to a member whose name/location the filter would reject.
• Control failure: the "skip" signal (None) from the filter is dropped for one of the two invocations.

No specific function names beyond extract/extractall semantics, name, None, and the filter concept are asserted here, because the source description provides only those. Additional implementation-level identifiers (private helpers, module attributes) are not available in the supplied intelligence and are not fabricated.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (archive-based path traversal via a bypassed extraction filter) and the NVD description.

1. Reconnaissance / target identification. An attacker identifies an application that accepts tar archives for extraction — for example, a package upload/import pipeline, a backup-restore endpoint, a CI/CD artifact unpacking step, or a "restore from archive" feature — and that runs on a system whose filesystem does not support links. The attacker determines this directly (their own test environment mirrors the target platform) or by inference from the target's reported OS/filesystem.

2. Triggering the flaw class. The attacker crafts a tar archive containing a link entry whose target/link location is something the extraction filter function is designed to reject (e.g., resolves outside the intended extraction root). Because the host does not support links, tarfile takes the fallback path and extracts the member instead of creating the link. During this fallback, the filter is invoked twice; the return value for the call whose name is set to the link location is ignored. The attacker arranges the archive so that the ignored call is the one that would have returned None (skip), so the member is extracted despite the filter's rejection.

3. Payload / execution method (class level). The "payload" is the archive member's content and its destination path. By exploiting the dropped filter decision, the member (which can carry arbitrary file content) is written to a location the filter was meant to block. Class-level consequences include arbitrary file write within the reachable filesystem namespace of the extracting process. The exact path is attacker-controlled through the archive's member naming and link metadata; no specific endpoints or parameters can be cited because none are given.

4. Post-exploitation impact. Successful traversal/arbitration bypass can result in overwriting of application or system files, planting content outside the intended sandbox, or clobbering files the process can write — leading to integrity loss and potential code-execution escalation depending on what is overwritten and what runs next. Confidentiality may also be affected if the write location is read back or served by the application.

Note: Because this is a library-level issue with no public exploit and sparse description, the chain above stays at the vulnerability-class level; it does not assert specific code patterns, private function names, or endpoints that are not present in the supplied data.

Impact Assessment

• Business impact: Any product or internal pipeline that ingests third-party or user-supplied tar archives is exposed to unauthorized file writes on affected platforms. In the worst case (clobbering a startup script, config, or code file the process can write), impact escalates from integrity loss to code execution.
• Affected systems: Python applications using tarfile.extract()/extractall() with a filter function, running on filesystems/platforms that do not support links. The number of affected deployments cannot be quantified from the supplied data (Affected Versions list is empty; no OSV packages listed).
• Blast radius: Scoped to the privileges of the extracting process and the writable filesystem namespace reachable from the extraction root. Because the flaw defeats the filter — the primary traversal guard — the practical reach can extend beyond the intended extraction directory.
• CVSS subscores: Not available. No CVSS score or vector was supplied (CVSS: N/A), so exploitability/impact subscores cannot be reported. EPSS is not yet scored by FIRST.org; no value is asserted. CISA KEV: not listed. No public PoC, no Nuclei template, no exploit code observed.
• Confidence caveat: Impact is inferred from CWE-22 class behavior and the described filter-bypass; it is not corroborated by vendor advisories or in-the-wild telemetry in the supplied data.

Detection Guidance

Detection focuses on tar extraction activity and attempts to write files outside expected extraction roots, particularly where link handling or filter decisions are involved. Since the flaw is local/library-level, network signatures are indirect (e.g., archive upload traffic) and should be tuned per deployment.

Sigma Rule

title: Suspicious Tar Archive Extraction With Link Fallback and Filter Bypass
id: 7c9a1b42-0f3e-4d21-9a6e-0c5b87910001
status: experimental
description: Detects tar extraction processes handling archives containing link entries, indicating potential CVE-2026-87910 filter-bypass path traversal on link-unsupported systems.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87910
author: valtersit.com
date: 2026-01-01
logsource:
  category: process_creation
  product: linux
detection:
  selection_binary:
    Image|endswith:
      - '/python'
      - '/python3'
      - '/tar'
      - '/bsdtar'
  selection_args:
    CommandLine|contains:
      - 'tarfile'
      - 'extractall'
      - '.extract('
      - '--extract'
      - ' xf '
  condition: selection_binary and selection_args
falsepositives:
  - Legitimate package managers and backup tooling that routinely extract archives
level: low
tags:
  - attack.t1190
  - cwe.22

YARA Rule

rule CVE_2026_87910_Tarfile_Link_Filter_Bypass
{
    meta:
        author = "valtersit.com"
        description = "Detects tar archives containing link entries and traversal-style member names consistent with CVE-2026-87910 filter-bypass extraction"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87910"
        cve = "CVE-2026-87910"
        date = "2026-01-01"

    strings:
        $tar_magic = { 75 73 74 61 72 }            // "ustar" POSIX tar magic
        $type_symlink = { 00 32 }                  // typeflag '2' (symbolic link) truncated context
        $type_hardlink = { 00 31 }                 // typeflag '1' (hard link) truncated context
        $trav = "../" ascii
        $trav_win = "..\\" ascii
        $abs = "/etc/" ascii
        $abs_bin = "/bin/" ascii
        $abs_usr = "/usr/" ascii
        $etc_passwd = "etc/passwd" ascii
        $ssh = ".ssh/" ascii

    condition:
        $tar_magic at 257 and
        (uint8(156) == 0x31 or uint8(156) == 0x32) and
        (any of ($trav, $trav_win, $abs, $abs_bin, $abs_usr, $etc_passwd, $ssh))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87910 Potential Malicious Tar Archive Upload (link/traversal indicators)"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"ustar"; depth:300; content:"../"; within:4096; reference:cve,2026-87910; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87910; classtype:attempted-user; sid:8791001; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

process where event.type == "start" and
  process.name in ("python", "python3", "tar", "bsdtar") and
  process.args : ("*extractall*", "*.extract(*", "*tarfile*", "*--extract*") and
  process.parent.name != null

Splunk SPL Query

index=main (sourcetype=linux_audit OR sourcetype=sysmon OR sourcetype=WinEventLog)
| search (process_name IN ("python","python3","tar","bsdtar")) 
| search (CommandLine="*tarfile*" OR CommandLine="*extractall*" OR CommandLine="*-.extract(*" OR CommandLine="*--extract*")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as cmds by host, user, process_name
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="tarfile,cve-2026-87910,path_traversal,">
  <rule id="879100" level="8">
    <decoded_as>json</decoded_as>
    <field name="CommandLine">tarfile|extractall|\.extract\(|--extract</field>
    <description>CVE-2026-87910: Possible tar archive extraction with filter-bypass path traversal attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cwe_22,</group>
  </rule>
</group>

Detection caveat: Because CVE-2026-87910 is a local library-level flaw with no known exploit and no disclosed indicators, the rules above are behavioral heuristics targeting tar extraction and archive upload patterns. They will produce false positives on legitimate archive workflows and require environment-specific tuning. No C2 domains, hashes, or network IOCs are asserted because none are available.

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source; no vendor fix, workaround, or affected-version list was supplied.

1. Immediate mitigations

   • Do not extract untrusted tar archives on systems that lack link support, or reject archives containing link entries before extraction.
   • Where extraction is unavoidable, validate archive member names and destinations independently of tarfile's filter decision — do not rely solely on the filter return value. Inspect members and refuse any that resolve outside the intended root.
   • Extract into a locked-down sandbox/chroot with a non-privileged account so a traversal write has minimal reach.
   • Monitor and alert on extraction processes writing outside expected directories.

2. Patch / upgrade steps

   • No patch is available from tracked sources. Track the Python security advisories and the upstream tarfile change log, and apply a fixed Python release as soon as one addresses the dropped filter return value. When upgrading, re-test any filter= usage.

3. Long-term hardening

   • Adopt the principle of "filter then re-validate": treat any library-provided extraction filter as advisory and layer an independent allowlist on member names/paths.
   • Standardize on extracting to a dedicated, disposable directory on a filesystem whose link semantics match your assumptions, then move verified outputs into place.
   • Add CI checks that extract a corpus of malicious tar fixtures (traversal, link fallback) to catch regressions early.
   • Maintain SBOM visibility over Python runtime versions so affected interpreters can be prioritized when a fix ships.

References

• NVD — CVE-2026-87910: https://nvd.nist.gov/vuln/detail/CVE-2026-87910
• CWE-22 — Improper Limitation of a Pathname to a Restricted Directory (Path Traversal): https://cwe.mitre.org/data/definitions/22.html
• Python tarfile documentation (extraction filters): https://docs.python.org/3/library/tarfile.html#extraction-filters
• Python Security Advisories / PSF: https://www.python.org/news/security/
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Threat actor / exploitation status: No CISA KEV listing, no public PoC, no exploit code, no Nuclei template, and no threat-actor campaign attribution are present in the available intelligence. This report reflects the vulnerability as described; treat exploitation likelihood as unconfirmed pending vendor patching and public analysis.