CVE-2025-4517

Name of the Vulnerable Software and Affected Versions Python versions 3.12 through 3.13

Description An issue in the tarfile module allows arbitrary filesystem writes outside the extraction directory when extracting untrusted tar archives. This occurs when using the TarFile.extractall() or TarFile.extract() functions with the filter parameter set to data or tar. For Python 3.14 and later, the default value of filter changed to data, making usage relying on this default behavior also susceptible. An attacker could exploit this to modify files in arbitrary locations, cause data loss, or potentially achieve privilege escalation or container escape if the scripts are executed with root privileges.

Recommendations Update Python 3.12 to version 3.12.11 or later. Update Python 3.13 to version 3.13.4 or later. As a temporary workaround, avoid using the filter parameter with values data or tar when extracting untrusted archives.