---
cve: "CVE-2026-11940"
severity: "HIGH"
cvss: 7.8
epss: "0.8%"
vendor: "Python Software Foundation"
kev: false
exploited: false
published: "2026-06-23 17:16:40"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-10-29T19:49:49+01:00"
---

# CVE-2026-11940

> 7.8 HIGH · 🧪 PoC

## Beschreibung

tarfile.extractall() with the 'data' or 'tar'
 filter could be bypassed by a crafted archive where a hardlink 
references a symlink stored at a deeper name than the hardlink itself.  
The extraction fallback validated the symlink at it's archived location 
but recreated it at the hardlink's shallower
path, letting a relative
 target the filter judged contained escape the destination directory.  
This allowed a malicious tar archive to create a symlink pointing 
outside the destination, enabling out-of-destination file reads or 
writes. This was an incomplete fix of CVE-2025-4330.

## CNA-Record (Kanon, cvelistV5)

- CNA: **PSF**
- State: PUBLISHED
- Stand: 2026-08-13 00:28:51
- CNA-CVSS: **7.8** (`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **yes**
  - Technical Impact: **partial**

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |

## Schwachstellen-Klasse

- **CWE-22** — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
  The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
- **CWE-59** — Improper Link Resolution Before File Access ('Link Following')
  The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

## Angriffsmuster (CAPEC)

- [CAPEC-64 — Using Slashes and URL Encoding Combined to Bypass Validation Logic](https://capec.mitre.org/data/definitions/64.html) _(Severity: High)_
- [CAPEC-76 — Manipulating Web Input to File System Calls](https://capec.mitre.org/data/definitions/76.html) _(Severity: Very High)_
- [CAPEC-78 — Using Escaped Slashes in Alternate Encoding](https://capec.mitre.org/data/definitions/78.html) _(Severity: High)_
- [CAPEC-79 — Using Slashes in Alternate Encoding](https://capec.mitre.org/data/definitions/79.html) _(Severity: High)_
- [CAPEC-126 — Path Traversal](https://capec.mitre.org/data/definitions/126.html) _(Severity: Very High)_

## Patch verfügbar (OSV)

- 3a19c2f0b3e91ce8f23d0cc64d4c9ee557823f24
- 41388c9cb160d0886d5ca00d2e6c8782608a4549

## BSI-Hinweise (deutsch)

- [IBM QRadar SIEM: Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2026-3595) — _BSI-Einstufung: hoch_
  Ein Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um beliebigen Programmcode auszuführen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.
- [CPython: Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2026-2044) — _BSI-Einstufung: hoch_
  Ein Angreifer kann mehrere Schwachstellen in CPython ausnutzen, um Dateien zu manipulieren, Sicherheitsmaßnahmen zu umgehen oder vertrauliche Informationen offenzulegen.

## Referenzen

- <https://github.com/python/cpython/pull/151559>
- <https://mail.python.org/archives/list/security-announce@python.org/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/>
- <https://github.com/python/cpython/issues/151558>
- <https://github.com/python/cpython/commit/27dd970bf6b17ebca7c8ed486a40ab043ed7af8f>
- <https://github.com/python/cpython/commit/672825e2f36a57e173959b0d9d409d4560dab8df>
- <https://github.com/python/cpython/commit/771d12dda5140313db0ac550292987975651bbde>
- <https://github.com/python/cpython/commit/79c06bd5c6afa3c440d50faf7ee1b147c8832b4c>
- <https://github.com/python/cpython/commit/be13e86f6b9788a6f4d0419dffef72cbae5865c9>
- <https://github.com/python/cpython/commit/e5fdbd8d5aa923bd9111b112ea73bd6ec7c47877>
- <https://github.com/python/cpython/commit/0f852b3f07dd8e71e40326a51c02afbf16a42cc5>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-11940/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_