Skip to content

tarfile.data_filter doesn't handle symlinks with empty names #149486

Open
Open
tarfile.data_filter doesn't handle symlinks with empty names#149486
Assignees
encukou
Labels
stdlibStandard Library Python modules in the Lib/ directorytype-securityA security issue
@encukou

Description

@encukou
encukou
opened on May 7, 2026

tarfile.data_filter can be bypassed using a chain of empty-named symlinks (name="").

Linked PRs

Metadata

Metadata

Assignees

Labels

stdlibStandard Library Python modules in the Lib/ directorytype-securityA security issue

Projects

Tarfile issues

Status

No status

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions