CVE-2026-4360

ADVISORY - docker

Summary

In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.

EPSS Score⁠: 0.0027 (0.190)

Common Weakness Enumeration (CWE)

Impacted images

Advisories

Docker

CREATED

1 month ago

UPDATED

12 days ago

ADVISORY ID

CVE-2026-4360

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

Package	Type	OS Name	OS Version	Affected Ranges	Fix Versions
python	dhi	-	-	<3.15.0-beta4	3.15.0-beta4
alpine/python-3.10	apk	alpine	3.23	<3.15.0-beta4	3.15.0-beta4
alpine/python-3.11	apk	alpine	3.23	<3.15.0-beta4	3.15.0-beta4
alpine/python-3.12	apk	alpine	3.23	<3.15.0-beta4	3.15.0-beta4
alpine/python-3.13	apk	alpine	3.23	<3.15.0-beta4	3.15.0-beta4
alpine/python-3.14	apk	alpine	3.23	<3.15.0-beta4	3.15.0-beta4
debian/python-3.10	deb	debian	13	<3.15.0-beta4	3.15.0-beta4
debian/python-3.11	deb	debian	13	<3.15.0-beta4	3.15.0-beta4
debian/python-3.12	deb	debian	13	<3.15.0-beta4	3.15.0-beta4
debian/python-3.13	deb	debian	13	<3.15.0-beta4	3.15.0-beta4
debian/python-3.14	deb	debian	13	<3.15.0-beta4	3.15.0-beta4

Severity and metrics

No CVSS data available from this advisory.

Debian

CREATED

1 month ago

UPDATED

22 days ago

ADVISORY IDCVE-2026-4360⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Alow

Ubuntu

CREATED

1 month ago

UPDATED

26 days ago

ADVISORY IDCVE-2026-4360⁠

EXPLOITABILITY SCORE

3.9

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

5.3medium

Amazon

CREATED

1 day ago

UPDATED

1 day ago

ADVISORY IDALAS2023-2026-1995⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Ahigh

Amazon

CREATED

1 day ago

UPDATED

1 day ago

ADVISORY IDALAS2023-2026-1996⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Ahigh

Amazon

CREATED

1 day ago

UPDATED

1 day ago

ADVISORY IDALAS2023-2026-1997⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Ahigh

Amazon

CREATED

1 day ago

UPDATED

1 day ago

ADVISORY IDALAS2023-2026-1998⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Ahigh

Amazon

CREATED

1 day ago

UPDATED

1 day ago

ADVISORY IDALAS2023-2026-1999⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Ahigh

Bitnami

CREATED

27 days ago

UPDATED

9 days ago

ADVISORY ID

BIT-libpython-2026-4360

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

2low

Bitnami

CREATED

27 days ago

UPDATED

9 days ago

ADVISORY ID

BIT-python-2026-4360

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

2low

Bitnami

CREATED

27 days ago

UPDATED

9 days ago

ADVISORY ID

BIT-python-min-2026-4360

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

2low

Chainguard

CREATED

21 days ago

UPDATED

21 days ago

ADVISORY ID

CGA-2wjh-6ccq-ffgc

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

3 days ago

UPDATED

3 days ago

ADVISORY ID

MINI-2v93-fqj6-h3vv

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

3 days ago

UPDATED

3 days ago

ADVISORY ID

MINI-4fff-v756-hrq8

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

3 days ago

UPDATED

3 days ago

ADVISORY ID

MINI-6r42-ghcf-jcvp

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

3 days ago

UPDATED

3 days ago

ADVISORY ID

MINI-fw9w-44xr-g399

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

3 days ago

UPDATED

3 days ago

ADVISORY ID

MINI-wm8c-c6r2-29v3

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY