PT-2026-25023 · Python · Tarfile

Published 2026-03-12 · Updated 2026-04-29 · CVE-2025-13462

Positive Technologies (AI Summary)

CVSS v4.0

2.0

Low

Base vector

AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions tarfile module (affected versions not specified)

Description The 'tarfile' module incorrectly normalizes AREGTYPE blocks to DIRTYPE when processing multi-block members like GNUTYPE LONGNAME or GNUTYPE LONGLINK. This can cause crafted tar archives to be misinterpreted by the module compared to other implementations.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Special Elements Injection

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-74

CWE-20

CWE-434

Related Identifiers

BIT-LIBPYTHON-2025-13462

BIT-PYTHON-2025-13462

BIT-PYTHON-MIN-2025-13462

CVE-2025-13462

ECHO-2833-B900-AC3D

OESA-2026-1899

OESA-2026-1900

OESA-2026-1901

OESA-2026-1902

OPENSUSE-SU-2026:10469-1

OPENSUSE-SU-2026:10477-1

OPENSUSE-SU-2026:10478-1

OPENSUSE-SU-2026:10479-1

OPENSUSE-SU-2026:10480-1

OPENSUSE-SU-2026:10481-1

OPENSUSE-SU-2026:20517-1

PSF-2026-10

RHSA-2026:10118

RHSA-2026:11324

RHSA-2026:7443

RHSA-2026:7661

SUSE-SU-2026:1206-1

SUSE-SU-2026:1292-1

SUSE-SU-2026:1296-1

SUSE-SU-2026:1345-1

SUSE-SU-2026:1349-1

SUSE-SU-2026:1354-1

SUSE-SU-2026:1376-1

SUSE-SU-2026:1385-1

SUSE-SU-2026:1417-1

SUSE-SU-2026:1530-1

SUSE-SU-2026:1715-1

SUSE-SU-2026:21104-1

SUSE-SU-2026:21178-1

SUSE-SU-2026:21254-1

Affected Products

Tarfile

References · 98

• https://github.com/python/cpython/commit/72dde1016493c52abe857fc4a7bf6c40138b4114 · Patch
• https://github.com/python/cpython/commit/9a23b753552afa28e3a2f4d8863572fc66479406 · Patch
• https://github.com/python/cpython/pull/143934 · Patch
• https://github.com/python/cpython/commit/ae99fe3a33b43e303a05f012815cef60b611a9c7 · Patch
• https://github.com/python/cpython/commit/7ad3093d76a748af55bdb1d2e8aad3638163b017 · Patch
• https://github.com/python/cpython/commit/42d754e34c06e57ad6b8e7f92f32af679912d8ab · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2026:10478-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1385-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10480-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1349-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1900 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3644 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-13462 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10481-1 · Vendor Advisory
• https://mail.python.org/archives/list/[e-mail]/thread/EOMI5I66ZMKQ2INNFT6T7IAIKUGPZYIE · Vendor Advisory