CVE-2025-4138
published 2025-06-03CVE-2025-4138: Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata…
PriorityP346high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
1.15%
63.3th percentile
Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata.
You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information.
Note that for Python 3.14 or later the default value of filter= changed from "no filtering" to `"data", so if you are relying on this new default behavior then your usage is also affected.
Note that none of these vulnerabilities significantly affect the installation of source distributions which are tar archives as source distributions already allow arbitrary code execution during the build process. However when evaluating source distributions it's important to avoid installing source distributions with suspicious links.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | jython | < pypy3 7.3.20+dfsg-2 (forky) | pypy3 7.3.20+dfsg-2 (forky) |
| debian | pypy3 | < pypy3 7.3.20+dfsg-2 (forky) | pypy3 7.3.20+dfsg-2 (forky) |
| debian | python2.7 | < pypy3 7.3.20+dfsg-2 (forky) | pypy3 7.3.20+dfsg-2 (forky) |
| debian | python3.11 | < pypy3 7.3.20+dfsg-2 (forky) | pypy3 7.3.20+dfsg-2 (forky) |
| debian | python3.13 | < pypy3 7.3.20+dfsg-2 (forky) | pypy3 7.3.20+dfsg-2 (forky) |
| debian | python3.9 | < pypy3 7.3.20+dfsg-2 (forky) | pypy3 7.3.20+dfsg-2 (forky) |
| msrc | azl3_python3_3.12.9-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_tensorflow_2.16.1-9_on_azure_linux_3.0 | — | — |
| msrc | cbl2_python3_3.9.19-13_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_python3_3.9.19-14_on_cbl_mariner_2.0 | — | — |
| python_software_foundation | cpython | < 3.10.18 | 3.10.18 |
| python_software_foundation | cpython | >= 3.11.0 < 3.11.13 | 3.11.13 |
| python_software_foundation | cpython | >= 3.12.0 < 3.12.11 | 3.12.11 |
| python_software_foundation | cpython | >= 3.13.0 < 3.13.4 | 3.13.4 |
| python_software_foundation | cpython | >= 3.14.0a1 < 3.14.0b3 | 3.14.0b3 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
ghsa7.5HIGH
osv7.5HIGH
vendor_debian7.5LOW
vendor_msrc7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
astral-tokio-tar has a path traversal in tar extraction
osv·2025-09-23·CVSS 7.5
CVE-2025-59825 [HIGH] astral-tokio-tar has a path traversal in tar extraction
astral-tokio-tar has a path traversal in tar extraction
### Impact
In versions 0.5.3 and earlier of astral-tokio-tar, tar archives may extract outside of their intended destination directory when using the `Entry::unpack_in_raw` API. Additionally, the `Entry::allow_external_symlinks` control (which defaults to `true`) could be bypassed via a pair of symlinks that individually point within the destination but combine to point outside of it.
These behaviors could be used individually or combined to bypass the intended security control of limiting extraction to the given directory. This in turn would allow an attacker with a malicious tar archive to perform an arbitrary file write and potentially pivot into code execution (e.g. by overwriting a file that the user or system then executes or
GHSA
astral-tokio-tar has a path traversal in tar extraction
ghsa·2025-09-23·CVSS 7.5
CVE-2025-59825 [HIGH] CWE-22 astral-tokio-tar has a path traversal in tar extraction
astral-tokio-tar has a path traversal in tar extraction
### Impact
In versions 0.5.3 and earlier of astral-tokio-tar, tar archives may extract outside of their intended destination directory when using the `Entry::unpack_in_raw` API. Additionally, the `Entry::allow_external_symlinks` control (which defaults to `true`) could be bypassed via a pair of symlinks that individually point within the destination but combine to point outside of it.
These behaviors could be used individually or combined to bypass the intended security control of limiting extraction to the given directory. This in turn would allow an attacker with a malicious tar archive to perform an arbitrary file write and potentially pivot into code execution (e.g. by overwriting a file that the user or system then executes or
OSV
CVE-2025-4138: Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file met
osv·2025-06-03·CVSS 7.5
CVE-2025-4138 [HIGH] CVE-2025-4138: Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file met
Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata.
You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information.
Note that for Python 3.14 or later the default value of filter= changed from "no filtering" to `"data", so if you are relying on this new default behavior then your usage is also affected.
Note that none of these vulnerabilities significantly affect the installation of source distribu
GHSA
GHSA-4g4g-fqw4-prp2: Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file met
ghsa_unreviewed·2025-06-03
CVE-2025-4138 [HIGH] CWE-22 GHSA-4g4g-fqw4-prp2: Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file met
Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata.
You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information. Only Python versions 3.12 or later are affected by these vulnerabilities, earlier versions don't include the extraction filter feature.
Note that for Python 3.14 or later the default value of filter= changed from "no filtering" to `"data", so if you are relying on this new default beha
OSV
CVE-2025-4138: Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file met
osv·2025-06-03·CVSS 7.5
CVE-2025-4138 [HIGH] CVE-2025-4138: Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file met
Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information. Note that for Python 3.14 or later the default value of filter= changed from "no filtering" to `"data", so if you are relying on this new default behavior then your usage is also affected. Note that none of these vulnerabilities significantly affect the installation of source distribution
Ubuntu
Python vulnerabilities
vendor_ubuntu·2025-06-19
CVE-2025-4517 Python vulnerabilities
Title: Python vulnerabilities
Summary: Python could be made to overwrite files.
It was discovered that Python incorrectly handled tar archive extraction
with the filtering option. An attacker could possibly use this issue to
modify files in arbitrary filesystem locations and cause data loss.
Instructions: In general, a standard system update will make all the necessary changes.
Microsoft
Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory
vendor_msrc·2025-06-10·CVSS 7.5
CVE-2025-4138 [HIGH] CWE-22 Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory
Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
PSF: PSF
Customer Action Required: Yes
Remediation: CBL-Marin
Red Hat
cpython: python: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory
vendor_redhat·2025-06-03·CVSS 7.5
CVE-2025-4138 [HIGH] CWE-22 cpython: python: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory
cpython: python: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory
Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata.
You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information.
Note that for Python 3.14 or later the default value of filter= changed from "no filtering" to `"data", so if you are relying on this new default behavior then your usage is
Debian
CVE-2025-4138: jython - Allows the extraction filter to be ignored, allowing symlink targets to point ou...
vendor_debian·2025·CVSS 7.5
CVE-2025-4138 [HIGH] CVE-2025-4138: jython - Allows the extraction filter to be ignored, allowing symlink targets to point ou...
Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information. Note that for Python 3.14 or later the default value of filter= changed from "no filtering" to `"data", so if you are relying on this new default behavior then your usage is also affected. Note that none of these vulnerabilities significantly affect the installation of source distribution
No detection rules found.
No public exploits indexed.
https://gist.github.com/sethmlarson/52398e33eff261329a0180ac1d54f42fhttps://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951dahttps://github.com/python/cpython/commit/28463dba112af719df1e8b0391c46787ad756dd9https://github.com/python/cpython/commit/3612d8f51741b11f36f8fb0494d79086bac9390ahttps://github.com/python/cpython/commit/4633f3f497b1ff70e4a35b6fe2c907cbe2d4cb2ehttps://github.com/python/cpython/commit/9c1110ef6652687d7c55f590f909720eddde965ahttps://github.com/python/cpython/commit/9e0ac76d96cf80b49055f6d6b9a6763fb9215c2ahttps://github.com/python/cpython/commit/aa9eb5f757ceff461e6e996f12c89e5d9b583b01https://github.com/python/cpython/commit/dd8f187d0746da151e0025c51680979ac5b4cfb1https://github.com/python/cpython/issues/135034https://github.com/python/cpython/pull/135037https://mail.python.org/archives/list/[email protected]/thread/MAXIJJCUUMCL7ATZNDVEGGHUMQMUUKLG/
2025-06-03
Published