From 22a78cfa15c41c13e91ab1c0fb7f627492ef8875 Mon Sep 17 00:00:00 2001
From: sethmlarson <18519037+sethmlarson@users.noreply.github.com>
Date: Fri, 23 Oct 2026 00:43:19 +0000
Subject: [PATCH] Update OSV records from CVE

---
 .../python/PSF-0000-CVE-2026-114583.json      | 63 +++++++++++++++++++
 1 file changed, 63 insertions(+)
 create mode 100644 advisories/python/PSF-0000-CVE-2026-114583.json

diff --git a/advisories/python/PSF-0000-CVE-2026-114583.json b/advisories/python/PSF-0000-CVE-2026-114583.json
new file mode 100644
index 0000000..a35a5d5
--- /dev/null
+++ b/advisories/python/PSF-0000-CVE-2026-114583.json
@@ -0,0 +1,63 @@
+{
+  "schema_version": "1.5.0",
+  "id": "PSF-0000-CVE-2026-114583",
+  "aliases": [
+    "CVE-2026-114583"
+  ],
+  "published": "2026-10-22T20:57:36.019Z",
+  "modified": "2026-10-23T00:36:58.472Z",
+  "details": "tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter=\"tar\" to write files outside the destination directory, subject to the permissions of the extracting process.\n\nThis is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter.",
+  "affected": [
+    {
+      "ranges": [
+        {
+          "type": "GIT",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "0901ad4ffb22605f12b705d1c1197f0a01f0ba0b"
+            },
+            {
+              "fixed": "c6ada40177436e4e2533a7b252082b5f0c043477"
+            },
+            {
+              "fixed": "e7e0b3523ad6ba8472873dda594cf4021a16f8b5"
+            }
+          ],
+          "repo": "https://github.com/python/cpython"
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/python/cpython/pull/160098"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://github.com/python/cpython/issues/160097"
+    },
+    {
+      "type": "WEB",
+      "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/43JOWPRAV5DI3VZ4FUEUAZOHCATXXOCK/"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/python/cpython/commit/0901ad4ffb22605f12b705d1c1197f0a01f0ba0b"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/python/cpython/commit/c6ada40177436e4e2533a7b252082b5f0c043477"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/python/cpython/commit/e7e0b3523ad6ba8472873dda594cf4021a16f8b5"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": []
+  }
+}
\ No newline at end of file