{"id":"CVE-2026-41140","aliases":["GHSA-73h3-mf4w-8647","PYSEC-2026-2890"],"url":"https://o3.security/vulnerability/CVE-2026-41140","summary":"Poetry: Path traversal in tar extraction on Python 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4","details":"Poetry is a dependency manager for Python. Prior to 2.3.4, the extractall() function in src/poetry/utils/helpers.py:410-426 extracts sdist tarballs without path traversal protection on Python versions where tarfile.data_filter is unavailable. Considering only Python versions which are still supported by Poetry, these are 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4. This vulnerability is fixed in 2.3.4.","published":"2026-04-24T17:10:33.869Z","modified":"2026-08-12T03:51:35.484281825Z","cvss":null,"epss":{"score":0.00294,"percentile":0.21773,"asOf":"2026-08-13"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"poetry","fixedVersion":"2.3.4"}],"fix":null,"references":[{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41140.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24866"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-41140"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41140.json"},{"type":"ADVISORY","url":"https://github.com/python-poetry/poetry/security/advisories/GHSA-73h3-mf4w-8647"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41140"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461604"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:35.484281825Z"}}