Homepage

Directory Traversal The advisory has been revoked - it doesn't affect any version of package python3.14  (opens in a new tab)

Threat Intelligence

EPSS
0.75% (52nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-PYTHON314-18671741
  • published12 Aug 2026
  • disclosed23 Jun 2026
Report a new vulnerability Found a mistake?

Introduced: 23 Jun 2026

CVE-2026-11940  (opens in a new tab)
CWE-22  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream python3.14 package and not the python3.14 package as distributed by RHEL.

tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself.  The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory.  This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330.

References