Search: CVE-2026-19672

CVE-2026-19672 is a directory traversal vulnerability in the Python tarfile module affecting POSIX platforms. The issue allows creation of empty directories outside the intended extraction destination when member names contain path components that leave and then return to the destination directory. This does not affect Windows due to path normalization. Only empty directories are created outside the destination; file contents remain inside. The vulnerability affects CPython versions before 3.16.0 and has a medium severity rating with a CVSS score of 6.3.