CVE-2025-4138

Name of the Vulnerable Software and Affected Versions Python versions 3.12 through 3.13

Description An issue in the tarfile module allows the extraction filter to be ignored when extracting untrusted tar archives. This can enable an attacker to create symbolic links that point outside the destination directory, modify file metadata, and potentially modify files in arbitrary filesystem locations, leading to data loss or unauthorized access to protected information. The issue occurs when using the TarFile.extractall() or TarFile.extract() functions with the filter parameter set to data or tar. For Python versions 3.14 and later, the default value of the filter parameter is data, making usage relying on this default behavior also susceptible.

Recommendations Update Python 3.12 to version 3.12.7-1ubuntu2.2. Update Python 3.13 to version 3.13.0-1ubuntu0.3. Avoid using the filter parameter with values data or tar when extracting untrusted archives. Avoid installing source distributions containing suspicious links.