# CVE-2026-114583: tar filter allows writing outside destination via empty-named symlink

CVE-2026-114583 is fixed in 56 products on 3 platforms, first by Python 3.14 3.14.10, released October 25, 2026. 11 other affected products have no fix yet. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-114583
- Priority: Routine
- CVSS: 6.9 (Moderate)
- EPSS: 0.0026
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 22, 2026
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114583

## Description

tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter="tar" to write files outside the destination directory, subject to the permissions of the extracting process.  This is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Windows apps | Python 3.14 | 3.14.10 | [Python 3.14 3.14.10](https://patchblox.com/security/data/fix/windows-app/python.python.3.14-3.14.10.md) | Oct 25, 2026 |
| Linux | python3.11 Fedora 43 | 3.11.18-1.fc43 | [FEDORA-2026-30D5BD99E3](https://patchblox.com/security/data/fix/linux/fedora-2026-30d5bd99e3.md) | Nov 7, 2026 |
| Linux | python3.11 amzn 2023 | 3.11.18-1.amzn2023.0.1 | [ALAS2023-2026-3356](https://patchblox.com/security/data/fix/linux/alas2023-2026-3356.md) | Nov 7, 2026 |
| Linux | python3.11-debug Fedora 43 | 3.11.18-1.fc43 | [FEDORA-2026-30D5BD99E3](https://patchblox.com/security/data/fix/linux/fedora-2026-30d5bd99e3.md) | Nov 7, 2026 |
| Linux | python3.11-debug amzn 2023 | 3.11.18-1.amzn2023.0.1 | [ALAS2023-2026-3356](https://patchblox.com/security/data/fix/linux/alas2023-2026-3356.md) | Nov 7, 2026 |
| Linux | python3.11-debuginfo Fedora 43 | 3.11.18-1.fc43 | [FEDORA-2026-30D5BD99E3](https://patchblox.com/security/data/fix/linux/fedora-2026-30d5bd99e3.md) | Nov 7, 2026 |
| Linux | python3.11-debuginfo amzn 2023 | 3.11.18-1.amzn2023.0.1 | [ALAS2023-2026-3356](https://patchblox.com/security/data/fix/linux/alas2023-2026-3356.md) | Nov 7, 2026 |
| Linux | python3.11-debugsource Fedora 43 | 3.11.18-1.fc43 | [FEDORA-2026-30D5BD99E3](https://patchblox.com/security/data/fix/linux/fedora-2026-30d5bd99e3.md) | Nov 7, 2026 |
| Linux | python3.11-debugsource amzn 2023 | 3.11.18-1.amzn2023.0.1 | [ALAS2023-2026-3356](https://patchblox.com/security/data/fix/linux/alas2023-2026-3356.md) | Nov 7, 2026 |
| Linux | python3.11-devel Fedora 43 | 3.11.18-1.fc43 | [FEDORA-2026-30D5BD99E3](https://patchblox.com/security/data/fix/linux/fedora-2026-30d5bd99e3.md) | Nov 7, 2026 |
| Linux | python3.11-devel amzn 2023 | 3.11.18-1.amzn2023.0.1 | [ALAS2023-2026-3356](https://patchblox.com/security/data/fix/linux/alas2023-2026-3356.md) | Nov 7, 2026 |
| Linux | python3.11-idle Fedora 43 | 3.11.18-1.fc43 | [FEDORA-2026-30D5BD99E3](https://patchblox.com/security/data/fix/linux/fedora-2026-30d5bd99e3.md) | Nov 7, 2026 |
| Linux | python3.11-idle amzn 2023 | 3.11.18-1.amzn2023.0.1 | [ALAS2023-2026-3356](https://patchblox.com/security/data/fix/linux/alas2023-2026-3356.md) | Nov 7, 2026 |
| Linux | python3.11-libs Fedora 43 | 3.11.18-1.fc43 | [FEDORA-2026-30D5BD99E3](https://patchblox.com/security/data/fix/linux/fedora-2026-30d5bd99e3.md) | Nov 7, 2026 |
| Linux | python3.11-libs amzn 2023 | 3.11.18-1.amzn2023.0.1 | [ALAS2023-2026-3356](https://patchblox.com/security/data/fix/linux/alas2023-2026-3356.md) | Nov 7, 2026 |
| Linux | python3.11-test Fedora 43 | 3.11.18-1.fc43 | [FEDORA-2026-30D5BD99E3](https://patchblox.com/security/data/fix/linux/fedora-2026-30d5bd99e3.md) | Nov 7, 2026 |
| Linux | python3.11-test amzn 2023 | 3.11.18-1.amzn2023.0.1 | [ALAS2023-2026-3356](https://patchblox.com/security/data/fix/linux/alas2023-2026-3356.md) | Nov 7, 2026 |
| Linux | python3.11-tkinter Fedora 43 | 3.11.18-1.fc43 | [FEDORA-2026-30D5BD99E3](https://patchblox.com/security/data/fix/linux/fedora-2026-30d5bd99e3.md) | Nov 7, 2026 |
| Linux | python3.11-tkinter amzn 2023 | 3.11.18-1.amzn2023.0.1 | [ALAS2023-2026-3356](https://patchblox.com/security/data/fix/linux/alas2023-2026-3356.md) | Nov 7, 2026 |
| Linux | python3.12 Fedora 43 | 3.12.16-2.fc43 | [FEDORA-2026-4E3279AF04](https://patchblox.com/security/data/fix/linux/fedora-2026-4e3279af04.md) | Nov 8, 2026 |
| Linux | python3.12-debug Fedora 43 | 3.12.16-2.fc43 | [FEDORA-2026-4E3279AF04](https://patchblox.com/security/data/fix/linux/fedora-2026-4e3279af04.md) | Nov 8, 2026 |
| Linux | python3.12-debuginfo Fedora 43 | 3.12.16-2.fc43 | [FEDORA-2026-4E3279AF04](https://patchblox.com/security/data/fix/linux/fedora-2026-4e3279af04.md) | Nov 8, 2026 |
| Linux | python3.12-debugsource Fedora 43 | 3.12.16-2.fc43 | [FEDORA-2026-4E3279AF04](https://patchblox.com/security/data/fix/linux/fedora-2026-4e3279af04.md) | Nov 8, 2026 |
| Linux | python3.12-devel Fedora 43 | 3.12.16-2.fc43 | [FEDORA-2026-4E3279AF04](https://patchblox.com/security/data/fix/linux/fedora-2026-4e3279af04.md) | Nov 8, 2026 |
| Linux | python3.12-idle Fedora 43 | 3.12.16-2.fc43 | [FEDORA-2026-4E3279AF04](https://patchblox.com/security/data/fix/linux/fedora-2026-4e3279af04.md) | Nov 8, 2026 |
| Linux | python3.12-libs Fedora 43 | 3.12.16-2.fc43 | [FEDORA-2026-4E3279AF04](https://patchblox.com/security/data/fix/linux/fedora-2026-4e3279af04.md) | Nov 8, 2026 |
| Linux | python3.12-test Fedora 43 | 3.12.16-2.fc43 | [FEDORA-2026-4E3279AF04](https://patchblox.com/security/data/fix/linux/fedora-2026-4e3279af04.md) | Nov 8, 2026 |
| Linux | python3.12-tkinter Fedora 43 | 3.12.16-2.fc43 | [FEDORA-2026-4E3279AF04](https://patchblox.com/security/data/fix/linux/fedora-2026-4e3279af04.md) | Nov 8, 2026 |
| Linux | python3.13 Fedora 43 | 3.13.18-1.fc43 | [FEDORA-2026-D6B8383232](https://patchblox.com/security/data/fix/linux/fedora-2026-d6b8383232.md) | Nov 7, 2026 |
| Linux | python3.13-debug Fedora 43 | 3.13.18-1.fc43 | [FEDORA-2026-D6B8383232](https://patchblox.com/security/data/fix/linux/fedora-2026-d6b8383232.md) | Nov 7, 2026 |
| Linux | python3.13-debuginfo Fedora 43 | 3.13.18-1.fc43 | [FEDORA-2026-D6B8383232](https://patchblox.com/security/data/fix/linux/fedora-2026-d6b8383232.md) | Nov 7, 2026 |
| Linux | python3.13-debugsource Fedora 43 | 3.13.18-1.fc43 | [FEDORA-2026-D6B8383232](https://patchblox.com/security/data/fix/linux/fedora-2026-d6b8383232.md) | Nov 7, 2026 |
| Linux | python3.13-devel Fedora 43 | 3.13.18-1.fc43 | [FEDORA-2026-D6B8383232](https://patchblox.com/security/data/fix/linux/fedora-2026-d6b8383232.md) | Nov 7, 2026 |
| Linux | python3.13-freethreading Fedora 43 | 3.13.18-1.fc43 | [FEDORA-2026-D6B8383232](https://patchblox.com/security/data/fix/linux/fedora-2026-d6b8383232.md) | Nov 7, 2026 |
| Linux | python3.13-freethreading-debug Fedora 43 | 3.13.18-1.fc43 | [FEDORA-2026-D6B8383232](https://patchblox.com/security/data/fix/linux/fedora-2026-d6b8383232.md) | Nov 7, 2026 |
| Linux | python3.13-idle Fedora 43 | 3.13.18-1.fc43 | [FEDORA-2026-D6B8383232](https://patchblox.com/security/data/fix/linux/fedora-2026-d6b8383232.md) | Nov 7, 2026 |
| Linux | python3.13-libs Fedora 43 | 3.13.18-1.fc43 | [FEDORA-2026-D6B8383232](https://patchblox.com/security/data/fix/linux/fedora-2026-d6b8383232.md) | Nov 7, 2026 |
| Linux | python3.13-test Fedora 43 | 3.13.18-1.fc43 | [FEDORA-2026-D6B8383232](https://patchblox.com/security/data/fix/linux/fedora-2026-d6b8383232.md) | Nov 7, 2026 |
| Linux | python3.13-tkinter Fedora 43 | 3.13.18-1.fc43 | [FEDORA-2026-D6B8383232](https://patchblox.com/security/data/fix/linux/fedora-2026-d6b8383232.md) | Nov 7, 2026 |
| Linux | python3.14 Debian 14 | 3.14.9-1 | [DEBIAN-CVE-2026-114583](https://patchblox.com/security/data/fix/linux/debian-cve-2026-114583.md) | Nov 3, 2026 |
| Linux | python3.15 Debian 14 | 3.15.1-1 | [DEBIAN-CVE-2026-114583](https://patchblox.com/security/data/fix/linux/debian-cve-2026-114583.md) | Nov 3, 2026 |
| Linux | python3.15 Fedora 43 | 3.15.2-1.fc43 | [FEDORA-2026-5E4931D206](https://patchblox.com/security/data/fix/linux/fedora-2026-5e4931d206.md) | Nov 7, 2026 |
| Linux | python3.15-debug Fedora 43 | 3.15.2-1.fc43 | [FEDORA-2026-5E4931D206](https://patchblox.com/security/data/fix/linux/fedora-2026-5e4931d206.md) | Nov 7, 2026 |
| Linux | python3.15-debug-debuginfo Fedora 43 | 3.15.2-1.fc43 | [FEDORA-2026-5E4931D206](https://patchblox.com/security/data/fix/linux/fedora-2026-5e4931d206.md) | Nov 7, 2026 |
| Linux | python3.15-debuginfo Fedora 43 | 3.15.2-1.fc43 | [FEDORA-2026-5E4931D206](https://patchblox.com/security/data/fix/linux/fedora-2026-5e4931d206.md) | Nov 7, 2026 |
| Linux | python3.15-debugsource Fedora 43 | 3.15.2-1.fc43 | [FEDORA-2026-5E4931D206](https://patchblox.com/security/data/fix/linux/fedora-2026-5e4931d206.md) | Nov 7, 2026 |
| Linux | python3.15-devel Fedora 43 | 3.15.2-1.fc43 | [FEDORA-2026-5E4931D206](https://patchblox.com/security/data/fix/linux/fedora-2026-5e4931d206.md) | Nov 7, 2026 |
| Linux | python3.15-freethreading Fedora 43 | 3.15.2-1.fc43 | [FEDORA-2026-5E4931D206](https://patchblox.com/security/data/fix/linux/fedora-2026-5e4931d206.md) | Nov 7, 2026 |
| Linux | python3.15-freethreading-debug Fedora 43 | 3.15.2-1.fc43 | [FEDORA-2026-5E4931D206](https://patchblox.com/security/data/fix/linux/fedora-2026-5e4931d206.md) | Nov 7, 2026 |
| Linux | python3.15-freethreading-debug-debuginfo Fedora 43 | 3.15.2-1.fc43 | [FEDORA-2026-5E4931D206](https://patchblox.com/security/data/fix/linux/fedora-2026-5e4931d206.md) | Nov 7, 2026 |
| Linux | python3.15-freethreading-debuginfo Fedora 43 | 3.15.2-1.fc43 | [FEDORA-2026-5E4931D206](https://patchblox.com/security/data/fix/linux/fedora-2026-5e4931d206.md) | Nov 7, 2026 |
| Linux | python3.15-freethreading-devel Fedora 43 | 3.15.2-1.fc43 | [FEDORA-2026-5E4931D206](https://patchblox.com/security/data/fix/linux/fedora-2026-5e4931d206.md) | Nov 7, 2026 |
| Linux | python3.15-freethreading-idle Fedora 43 | 3.15.2-1.fc43 | [FEDORA-2026-5E4931D206](https://patchblox.com/security/data/fix/linux/fedora-2026-5e4931d206.md) | Nov 7, 2026 |
| Linux | python3.15-freethreading-libs Fedora 43 | 3.15.2-1.fc43 | [FEDORA-2026-5E4931D206](https://patchblox.com/security/data/fix/linux/fedora-2026-5e4931d206.md) | Nov 7, 2026 |
| Linux | python3.15-freethreading-libs-debuginfo Fedora 43 | 3.15.2-1.fc43 | [FEDORA-2026-5E4931D206](https://patchblox.com/security/data/fix/linux/fedora-2026-5e4931d206.md) | Nov 7, 2026 |
| Linux | python3.15-freethreading-test Fedora 43 | 3.15.2-1.fc43 | [FEDORA-2026-5E4931D206](https://patchblox.com/security/data/fix/linux/fedora-2026-5e4931d206.md) | Nov 7, 2026 |
| Linux | python3.15-freethreading-test-debuginfo Fedora 43 | 3.15.2-1.fc43 | [FEDORA-2026-5E4931D206](https://patchblox.com/security/data/fix/linux/fedora-2026-5e4931d206.md) | Nov 7, 2026 |
| Linux | python3.15-freethreading-tkinter Fedora 43 | 3.15.2-1.fc43 | [FEDORA-2026-5E4931D206](https://patchblox.com/security/data/fix/linux/fedora-2026-5e4931d206.md) | Nov 7, 2026 |
| Linux | python3.15-freethreading-tkinter-debuginfo Fedora 43 | 3.15.2-1.fc43 | [FEDORA-2026-5E4931D206](https://patchblox.com/security/data/fix/linux/fedora-2026-5e4931d206.md) | Nov 7, 2026 |
| Linux | python3.15-idle Fedora 43 | 3.15.2-1.fc43 | [FEDORA-2026-5E4931D206](https://patchblox.com/security/data/fix/linux/fedora-2026-5e4931d206.md) | Nov 7, 2026 |
| Linux | python3.15-libs Fedora 43 | 3.15.2-1.fc43 | [FEDORA-2026-5E4931D206](https://patchblox.com/security/data/fix/linux/fedora-2026-5e4931d206.md) | Nov 7, 2026 |
| Linux | python3.15-libs-debuginfo Fedora 43 | 3.15.2-1.fc43 | [FEDORA-2026-5E4931D206](https://patchblox.com/security/data/fix/linux/fedora-2026-5e4931d206.md) | Nov 7, 2026 |
| Linux | python3.15-test Fedora 43 | 3.15.2-1.fc43 | [FEDORA-2026-5E4931D206](https://patchblox.com/security/data/fix/linux/fedora-2026-5e4931d206.md) | Nov 7, 2026 |
| Linux | python3.15-test-debuginfo Fedora 43 | 3.15.2-1.fc43 | [FEDORA-2026-5E4931D206](https://patchblox.com/security/data/fix/linux/fedora-2026-5e4931d206.md) | Nov 7, 2026 |
| Linux | python3.15-tkinter Fedora 43 | 3.15.2-1.fc43 | [FEDORA-2026-5E4931D206](https://patchblox.com/security/data/fix/linux/fedora-2026-5e4931d206.md) | Nov 7, 2026 |
| Linux | python3.15-tkinter-debuginfo Fedora 43 | 3.15.2-1.fc43 | [FEDORA-2026-5E4931D206](https://patchblox.com/security/data/fix/linux/fedora-2026-5e4931d206.md) | Nov 7, 2026 |

## No fix yet

| Platform | Product | Status |
|---|---|---|
| Windows apps | Python 2 | no-fix |
| Windows apps | Python 3.10 | no-fix |
| Windows apps | Python 3.11 | no-fix |
| Windows apps | Python 3.12 | no-fix |
| Windows apps | Python 3.13 | no-fix |
| Windows apps | Python 3.5 | no-fix |
| Windows apps | Python 3.6 | no-fix |
| Windows apps | Python 3.7 | no-fix |
| Windows apps | Python 3.8 | no-fix |
| Windows apps | Python 3.9 | no-fix |
| macOS | Python3 | no-fix |

---

Data as of 2026-11-09T19:38:12Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.