tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1910 advisory.

    tarfile.extractall() with the 'data' or 'tar'filter could be bypassed by a crafted archive where a     hardlinkreferences a symlink stored at a deeper name than the hardlink itself.The extraction fallback     validated the symlink at it's archived locationbut recreated it at the hardlink's shallowerpath, letting a     relativetarget the filter judged contained escape the destination directory.This allowed a malicious tar     archive to create a symlink pointingoutside the destination, enabling out-of-destination file reads     orwrites. This was an incomplete fix of CVE-2025-4330. (CVE-2026-11940)

    CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. (CVE-2026-1502)

    unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input     containing long runs of combining characters with alternating Canonical Combining Class values. This     affects all normalization forms. (CVE-2026-3276)

    `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding     protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this     vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch. (CVE-2026-7210)

    tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or     directory-like names, to redirect later archive members outside the intended extraction directory. This     allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination     directory, subject to the permissions of the extracting process. (CVE-2026-7774)

    The ftpcp() function in Lib/ftplib.py was not updated whenCVE-2021-4189 was fixed. While makepasv() was     patched to replaceserver-supplied PASV host addresses with the actual peer address(getpeername()[0]),     ftpcp() still calls parse227() directly and passesthe raw attacker-controllable IP address and port to     target.sendport(). This patch is related to CVE-2021-4189. (CVE-2026-8328)

    bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the     resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to     resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash     the process when processing untrusted data. (CVE-2026-9669)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1929 advisory.

    tarfile.extractall() with the 'data' or 'tar'filter could be bypassed by a crafted archive where a     hardlinkreferences a symlink stored at a deeper name than the hardlink itself.The extraction fallback     validated the symlink at it's archived locationbut recreated it at the hardlink's shallowerpath, letting a     relativetarget the filter judged contained escape the destination directory.This allowed a malicious tar     archive to create a symlink pointingoutside the destination, enabling out-of-destination file reads     orwrites. This was an incomplete fix of CVE-2025-4330. (CVE-2026-11940)

    unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input     containing long runs of combining characters with alternating Canonical Combining Class values. This     affects all normalization forms. (CVE-2026-3276)

    tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or     directory-like names, to redirect later archive members outside the intended extraction directory. This     allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination     directory, subject to the permissions of the extracting process. (CVE-2026-7774)

    The ftpcp() function in Lib/ftplib.py was not updated whenCVE-2021-4189 was fixed. While makepasv() was     patched to replaceserver-supplied PASV host addresses with the actual peer address(getpeername()[0]),     ftpcp() still calls parse227() directly and passesthe raw attacker-controllable IP address and port to     target.sendport(). This patch is related to CVE-2021-4189. (CVE-2026-8328)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8509-1 advisory.

    It was discovered that Python incorrectly normalized paths in the tarfile module. An attacker could     possibly use this issue to bypass path restrictions. This issue only affected Ubuntu 22.04 LTS and Ubuntu     24.04 LTS. (CVE-2025-13462)

    It was discovered that Python's HTMLParser incorrectly handled certain malformed HTML input. An attacker     could possibly use this issue to cause Python to crash, resulting in a denial of service. This issue only     affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-69534)

    It was discovered that Python's email module incorrectly quoted newlines in headers. An attacker could     possibly use this issue to inject arbitrary email headers. This issue only affected Ubuntu 22.04 LTS and     Ubuntu 24.04 LTS. (CVE-2026-1299)

    It was discovered that Python's http.client module did not properly sanitize carriage return and linefeed     characters when handling HTTP CONNECT tunnel request headers. An attacker could possibly use this issue to     inject arbitrary HTTP headers. (CVE-2026-1502)

    It was discovered that Python's importlib module did not generate an audit event when loading legacy .pyc     files. An attacker could possibly use this issue to bypass auditing mechanisms. This issue only affected     Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-2297)

    It was discovered that Python's unicodedata.normalize() function had incorrect algorithmic complexity. An     attacker could possibly use this issue to cause Python to consume excessive resources, leading to a denial     of service. (CVE-2026-3276)

    It was discovered that Python's http.cookies module incorrectly handled control characters in certain     cookie operations. An attacker could possibly use this issue to inject arbitrary content. This issue only     affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-3644)

    It was discovered that the Python pyexpat module was vulnerable to unbounded recursion in the Expat XML     parser. An attacker could possibly use this issue to cause Python to crash, resulting in a denial of     service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-4224)

    It was discovered that Python's webbrowser module accepted leading dashes in URLs, which could be     interpreted as command-line options. An attacker could possibly use this issue to execute arbitrary     commands. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-4519)

    It was discovered that Python incorrectly handled webbrowser.open() handlers. An attacker could possibly     use this issue to execute arbitrary commands. (CVE-2026-4786)

    It was discovered that Python's remote debugging module did not properly validate offset tables when     loading debug information. An attacker could possibly use this issue to cause Python to crash or execute     arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-5713)

    It was discovered that Python's http.cookies module incorrectly escaped values in the js_output() method.
    An attacker could possibly use this issue to inject arbitrary JavaScript. (CVE-2026-6019)

    It was discovered that Python's lzma, bz2, and gzip decompressor objects had a use-after-free     vulnerability. An attacker could possibly use this issue to cause Python to crash or execute arbitrary     code. (CVE-2026-6100)

    It was discovered that Python's tarfile module did not properly validate link targets when using the data     filter. An attacker could possibly use this issue to bypass path restrictions. This issue only affected     Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-7774)

    It was discovered that the fix for CVE-2021-4189 in Python's ftplib module was incomplete, allowing PASV     responses to be used in ftplib.ftpcp(). An attacker could possibly use this issue to perform server-side     request forgery attacks. (CVE-2026-8328)

    It was discovered that Python's bz2 module allowed reuse of a BZ2Decompressor object after a decompression     error. An attacker could possibly use this issue to cause Python to crash or execute arbitrary code.
    (CVE-2026-9669)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Python installed on the remote Windows host is affected by a path traversal vulnerability.
tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or     directory-like names, to redirect later archive members outside the intended extraction directory. This     allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination     directory, subject to the permissions of the extracting process. (CVE-2026-7774)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
327378	Amazon Linux 2023 : python3.13, python3.13-devel, python3.13-freethreading (ALAS2023-2026-1910)	Nessus	Amazon Linux Local Security Checks	high
327372	Amazon Linux 2023 : python3.14, python3.14-devel, python3.14-freethreading (ALAS2023-2026-1929)	Nessus	Amazon Linux Local Security Checks	high
325428	Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : Python vulnerabilities (USN-8509-1)	Nessus	Ubuntu Local Security Checks	critical
320851	Python 3.10.x / 3.11.x / 3.12.x / 3.13.x < 3.13.14 / 3.14.x < 3.14.6 Path Traversal	Nessus	Windows	medium
318726	Linux Distros Unpatched Vulnerability : CVE-2026-7774	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-7774

medium

Tenable Plugins

high

high

critical

medium

medium