CVE-2024-12718
published 2025-06-03CVE-2024-12718: Allows modifying some file metadata (e.g. last modified) with filter="data" or file permissions (chmod) with filter="tar" of files outside the extraction…
PriorityP432medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
0.64%
46.5th percentile
Allows modifying some file metadata (e.g. last modified) with filter="data" or file permissions (chmod) with filter="tar" of files outside the extraction directory.
You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information. Only Python versions 3.12 or later are affected by these vulnerabilities, earlier versions don't include the extraction filter feature.
Note that for Python 3.14 or later the default value of filter= changed from "no filtering" to `"data", so if you are relying on this new default behavior then your usage is also affected.
Note that none of these vulnerabilities significantly affect the installation of source distributions which are tar archives as source distributions already allow arbitrary code execution during the build process. However when evaluating source distributions it's important to avoid installing source distributions with suspicious links.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | jython | < pypy3 7.3.20+dfsg-2 (forky) | pypy3 7.3.20+dfsg-2 (forky) |
| debian | pypy3 | < pypy3 7.3.20+dfsg-2 (forky) | pypy3 7.3.20+dfsg-2 (forky) |
| debian | python2.7 | < pypy3 7.3.20+dfsg-2 (forky) | pypy3 7.3.20+dfsg-2 (forky) |
| debian | python3.11 | < pypy3 7.3.20+dfsg-2 (forky) | pypy3 7.3.20+dfsg-2 (forky) |
| debian | python3.13 | < pypy3 7.3.20+dfsg-2 (forky) | pypy3 7.3.20+dfsg-2 (forky) |
| debian | python3.9 | < pypy3 7.3.20+dfsg-2 (forky) | pypy3 7.3.20+dfsg-2 (forky) |
| msrc | azl3_python3_3.12.9-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_tensorflow_2.16.1-9_on_azure_linux_3.0 | — | — |
| msrc | cbl2_python3_3.9.19-13_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_python3_3.9.19-14_on_cbl_mariner_2.0 | — | — |
| python_software_foundation | cpython | < 3.10.18 | 3.10.18 |
| python_software_foundation | cpython | >= 3.11.0 < 3.11.13 | 3.11.13 |
| python_software_foundation | cpython | >= 3.12.0 < 3.12.11 | 3.12.11 |
| python_software_foundation | cpython | >= 3.13.0 < 3.13.4 | 3.13.4 |
| python_software_foundation | cpython | >= 3.14.0a1 < 3.14.0b3 | 3.14.0b3 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
osv5.3MEDIUM
vendor_debian5.3LOW
vendor_redhat5.3MEDIUM
vendor_msrc4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Python vulnerabilities
vendor_ubuntu·2025-06-19
CVE-2025-4517 Python vulnerabilities
Title: Python vulnerabilities
Summary: Python could be made to overwrite files.
It was discovered that Python incorrectly handled tar archive extraction
with the filtering option. An attacker could possibly use this issue to
modify files in arbitrary filesystem locations and cause data loss.
Instructions: In general, a standard system update will make all the necessary changes.
Microsoft
Bypass extraction filter to modify file metadata outside extraction directory
vendor_msrc·2025-06-10·CVSS 4.3
CVE-2024-12718 [MEDIUM] CWE-22 Bypass extraction filter to modify file metadata outside extraction directory
Bypass extraction filter to modify file metadata outside extraction directory
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
PSF: PSF
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Refere
Red Hat
cpython: python: Bypass extraction filter to modify file metadata outside extraction directory
vendor_redhat·2025-06-03·CVSS 5.3
CVE-2024-12718 [MEDIUM] CWE-22 cpython: python: Bypass extraction filter to modify file metadata outside extraction directory
cpython: python: Bypass extraction filter to modify file metadata outside extraction directory
Allows modifying some file metadata (e.g. last modified) with filter="data" or file permissions (chmod) with filter="tar" of files outside the extraction directory.
You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information. Only Python versions 3.12 or later are affected by these vulnerabilities, earlier versions don't include the extraction filter feature.
Note that for Python 3.14 or later the default va
Debian
CVE-2024-12718: jython - Allows modifying some file metadata (e.g. last modified) with filter="data" or f...
vendor_debian·2024·CVSS 5.3
CVE-2024-12718 [MEDIUM] CVE-2024-12718: jython - Allows modifying some file metadata (e.g. last modified) with filter="data" or f...
Allows modifying some file metadata (e.g. last modified) with filter="data" or file permissions (chmod) with filter="tar" of files outside the extraction directory. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information. Only Python versions 3.12 or later are affected by these vulnerabilities, earlier versions don't include the extraction filter feature. Note that for Python 3.14 or later the default value of filter= changed from "no filtering" to `"data", so if you are relying on this new default
OSV
CVE-2024-12718: Allows modifying some file metadata (e
osv·2025-06-03·CVSS 5.3
CVE-2024-12718 [MEDIUM] CVE-2024-12718: Allows modifying some file metadata (e
Allows modifying some file metadata (e.g. last modified) with filter="data" or file permissions (chmod) with filter="tar" of files outside the extraction directory. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information. Only Python versions 3.12 or later are affected by these vulnerabilities, earlier versions don't include the extraction filter feature. Note that for Python 3.14 or later the default value of filter= changed from "no filtering" to `"data", so if you are relying on this new default
GHSA
GHSA-2pg8-h2j6-28xm: Allows modifying some file metadata (e
ghsa_unreviewed·2025-06-03
CVE-2024-12718 [CRITICAL] CWE-22 GHSA-2pg8-h2j6-28xm: Allows modifying some file metadata (e
Allows modifying some file metadata (e.g. last modified) with filter="data" or file permissions (chmod) with filter="tar" of files outside the extraction directory.
You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information. Only Python versions 3.12 or later are affected by these vulnerabilities, earlier versions don't include the extraction filter feature.
Note that for Python 3.14 or later the default value of filter= changed from "no filtering" to `"data", so if you are relying on this new defaul
OSV
CVE-2024-12718: Allows modifying some file metadata (e
osv·2025-06-03·CVSS 5.3
CVE-2024-12718 [MEDIUM] CVE-2024-12718: Allows modifying some file metadata (e
Allows modifying some file metadata (e.g. last modified) with filter="data" or file permissions (chmod) with filter="tar" of files outside the extraction directory.
You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information. Only Python versions 3.12 or later are affected by these vulnerabilities, earlier versions don't include the extraction filter feature.
Note that for Python 3.14 or later the default value of filter= changed from "no filtering" to `"data", so if you are relying on this new defaul
No detection rules found.
No public exploits indexed.
https://gist.github.com/sethmlarson/52398e33eff261329a0180ac1d54f42fhttps://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951dahttps://github.com/python/cpython/commit/28463dba112af719df1e8b0391c46787ad756dd9https://github.com/python/cpython/commit/3612d8f51741b11f36f8fb0494d79086bac9390ahttps://github.com/python/cpython/commit/4633f3f497b1ff70e4a35b6fe2c907cbe2d4cb2ehttps://github.com/python/cpython/commit/9c1110ef6652687d7c55f590f909720eddde965ahttps://github.com/python/cpython/commit/9e0ac76d96cf80b49055f6d6b9a6763fb9215c2ahttps://github.com/python/cpython/commit/aa9eb5f757ceff461e6e996f12c89e5d9b583b01https://github.com/python/cpython/commit/dd8f187d0746da151e0025c51680979ac5b4cfb1https://github.com/python/cpython/issues/127987https://github.com/python/cpython/issues/135034https://github.com/python/cpython/pull/135037https://mail.python.org/archives/list/[email protected]/thread/MAXIJJCUUMCL7ATZNDVEGGHUMQMUUKLG/https://github.com/python/cpython/issues/127987
2025-06-03
Published