PT-2026-25023 · Python+3 · Tarfile+3
CVE-2025-13462
·
Published
2026-01-16
·
Updated
2026-08-13
CVSS v4.0
6.0
Medium
| Vector | AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
tarfile module (affected versions not specified)
Description
The 'tarfile' module incorrectly normalizes AREGTYPE blocks to DIRTYPE when processing multi-block members like GNUTYPE LONGNAME or GNUTYPE LONGLINK. This can cause crafted tar archives to be misinterpreted by the module compared to other implementations.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
DoS
RCE
Special Elements Injection
Unrestricted File Upload
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linuxmint
Red Os
Ubuntu
Tarfile