PT-2025-23611 · Python+11 · Python+11
Caleb Brown
+5
·
Published
2025-06-02
·
Updated
2026-05-18
·
CVE-2025-4517
CVSS v2.0
9.7
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:P |
Name of the Vulnerable Software and Affected Versions
Python versions 3.12 and later
Description
The issue allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data" when using the tarfile module to extract untrusted tar archives. This affects users of Python versions 3.12 or later, as earlier versions do not include the extraction filter feature. For Python 3.14 or later, the default value of filter changed to "data", so users relying on this new default behavior are also affected.
Recommendations
For Python versions 3.12 and later, update to a version where the issue is fixed, as the default behavior change in Python 3.14 or later may affect usage.
As a temporary workaround, consider avoiding the use of the filter parameter with a value of "data" or "tar" in TarFile.extractall() or TarFile.extract() until a patch is available.
Restrict access to untrusted tar archives to minimize the risk of exploitation.
Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Almalinux
Astra Linux
Centos
Debian
Ibm Aix
Linuxmint
Python
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu