CVE-2007-4559 — Path Traversal in Python

CWE-22 — Path Traversal15 documents8 sources
Severity
9.8CRITICALNVD
OSV2.1
EPSS
90.6%
top 0.38%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
PythonKerasPyload-ng Project Pyload-ng+4 more
Timeline
PublishedAug 28
Latest updateApr 8

Description

Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages7 packages

▶NVDpython/python3.7.0 — 3.8.17+4
▶PyPIkeras/keras< 3.12.0
▶PyPIpyload-ng_project/pyload-ng< 0.5.0b3.dev97

🔴Vulnerability Details

6
OSV
pyload-ng: Incomplete Tar Path Traversal Fix in UnTar._safe_extractall via os.path.commonprefix Bypass↗2026-04-08
▶
GHSA
pyload-ng: Incomplete Tar Path Traversal Fix in UnTar._safe_extractall via os.path.commonprefix Bypass↗2026-04-08
▶
OSV
Keras Directory Traversal Vulnerability↗2025-12-02
▶
GHSA
Keras Directory Traversal Vulnerability↗2025-12-02
▶
GHSA
GHSA-gw9q-c7gh-j9vm: Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attacker↗2022-05-01
▶

📋Vendor Advisories

2
Microsoft
CVE-2007-4559: NIST NVD Details: https://nvd↗2024-12-10
▶
Red Hat
python: tarfile module directory traversal↗2007-08-24
▶

📄Research Papers

2
arXiv
Applications of Positive Unlabeled (PU) and Negative Unlabeled (NU) Learning in Cybersecurity↗2024-12-09
▶
arXiv
When Less is Enough: Positive and Unlabeled Learning Model for Vulnerability Detection↗2023-08-21
▶

💬Community

4
Bugzilla
CVE-2008-1568 comix: Command executions via improper shell escaping↗2008-01-29
▶
Bugzilla
CVE-2007-4559 python tarfile module directory traversal [F7]↗2007-10-02
▶
Bugzilla
CVE-2007-4559 python tarfile module directory traversal [FC6]↗2007-10-02
▶
Bugzilla
CVE-2007-4559 python: tarfile module directory traversal↗2007-08-29
▶
CVE-2007-4559 — Path Traversal in Python | cvebase