CVE-2026-19672

tarfile extraction filter bypass allows creation of directories outside the destination

The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given. Only empty directories are created outside the destination. Member contents are still extracted inside it. To return to the destination the member's name must contain the destination directory's own final component, so extraction into a secure randomised directory is not affected. This affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created.

We have discovered 456 live websites that are affected by CVE-2026-19672.

Run a Free Instant Scan



Affected Software

Product  CPython
Category Programming Languages
Vulnerable Domains456 live websites (100% of CPython install base)
Vulnerable Versions
  • from 0 through 3.16
Vulnerable Versions Count65 versions ( 100% of all versions)



Details

  • Published - Aug 19, 2026
  • Updated - Aug 27, 2026

Credits

  • Lohinth (https://github.com/l0h1nth) (reporter)
  • Stan Ulbrych (https://github.com/StanFromIreland) (coordinator)
  • Petr Viktorin (https://github.com/encukou) (remediation reviewer)
  • Ethan Furman (https://github.com/ethanfurman) (remediation reviewer)

Website Distribution by Country

Number of websites using CVE-2026-19672
United States149 websites


Germany62 websites
Singapore28 websites
France22 websites
India19 websites
China13 websites
Russia12 websites
GB12 websites
Switzerland10 websites
Brazil9 websites

Website Distribution by TLD

Number of websites using CVE-2026-19672
.com164 websites
.org40 websites
.net23 websites
.dk23 websites
.de21 websites
.fr8 websites
.ch8 websites
.edu7 websites
.nl7 websites
.it6 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-19672

Top websites that are affected by CVE-2026-19672. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
**********.com United States**,***
*********.com Netherlands***,***
*******.***.org Germany***,***
****.***********.***.au Australia***,***
*************.com United States***,***
********.***.***.gr Greece***,***
***.********.it Italy***,***
***************.de Germany*,***,***
****.*****.br Brazil*,***,***
*********.com United States*,***,***
See full domain list

FAQ

A total of 456 websites have been identified as vulnerable to CVE-2026-19672, based on global website indexing conducted by WebTechSurvey.
The CPython is affected by the CVE-2026-19672 vulnerability.
CPython versions up to 3.16 are vulnerable to CVE-2026-19672.
CVE-2026-19672 is resolved in version 3.16 of CPython.