PT-2025-23608 · Python+11 · Python+11
Caleb Brown
+5
·
Published
2025-06-03
·
Updated
2026-05-18
·
CVE-2025-4138
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Python versions 3.12 and later
Description
The issue allows the extraction filter to be ignored, enabling symlink targets to point outside the destination directory and the modification of some file metadata. This affects users who extract untrusted tar archives using TarFile.extractall() or TarFile.extract() with the filter parameter set to "data" or "tar". For Python 3.14 and later, the default filter value changed to "data", which also affects usage relying on this new default behavior. The installation of source distributions, which are tar archives, is not significantly affected as they already allow arbitrary code execution during the build process.
Recommendations
For Python versions 3.12 and later, consider avoiding the use of the filter parameter with values "data" or "tar" when extracting untrusted tar archives using TarFile.extractall() or TarFile.extract() until a patch is available.
As a temporary workaround, consider disabling the extraction filter feature when dealing with untrusted archives.
For Python 3.14 and later, be cautious when relying on the new default filter behavior, as it may introduce this issue.
Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Almalinux
Astra Linux
Centos
Debian
Ibm Aix
Linuxmint
Python
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu