LiveActive security incident?Get immediate response
CVE Record

CVE-2025-4517: Arbitrary writes via tarfile realpath overflow

Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data". You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter  for more information. Note that for Python 3.14 or later the default value of filter= changed from "no filtering" to `"data", so if you are relying on this new default behavior then your usage is also affected. Note that none of these vulnerabilities significantly affect the installation of source distributions which are tar archives as source distributions already allow arbitrary code execution during the build process. However when evaluating source distributions it's important to avoid installing source distributions with suspicious links.

CriticalCVSS 9.4Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

A malicious tar archive can make affected Python applications write files outside the folder chosen for extraction. This could overwrite application data, configuration, or other files accessible to the Python process, potentially enabling broader compromise. Risk is concentrated in systems that automatically extract untrusted archives.

Executive priority

Treat remediation as urgent for systems accepting archives from customers, partners, email, or automated feeds. The potential impact includes high confidentiality and integrity loss. Prioritize exposure discovery and runtime updates, while using isolation or disabling untrusted extraction where immediate patching is not possible.

Technical view

CVE-2025-4517 is a CWE-22 boundary-validation flaw in CPython’s tarfile extraction handling. Crafted archives can bypass the intended extraction-directory restriction when TarFile.extract() or extractall() uses filter="data" or filter="tar". Python 3.14 and later are also exposed when relying on the new default filter="data" behavior.

Likely exposure

Highest exposure exists in internet-facing upload handlers, automated ingestion pipelines, scanners, and internal services that extract untrusted tar archives. Applications not processing untrusted archives through affected tarfile paths are less likely to be exploitable. The supplied version metadata does not identify exact fixed release numbers.

Exploitation context

The CVSS score is 9.4, reflecting remote, low-complexity exploitation without privileges or user interaction when an attacker can submit an archive for extraction. The supplied sources do not establish active exploitation, and the CVE is not identified as CISA KEV in the bundle.

Researcher notes

The bundle provides multiple CPython patch commits but not a definitive fixed-version matrix; verify maintained branches against the vendor advisory. The issue specifically includes data and tar filters, not only completely unfiltered extraction. Source-distribution installation is not significantly changed because building source distributions already permits code execution, though suspicious links remain relevant.

Mitigation direction

  • Upgrade each Python runtime to a vendor release containing the relevant CPython patch for its maintained branch.
  • Until upgraded, avoid extracting untrusted tar archives with Python tarfile.
  • If extraction is essential, apply the cited vendor mitigation and isolate processing with minimal filesystem privileges.
  • Prioritize externally reachable and automated archive-processing services.

Validation and detection

  • Inventory applications calling TarFile.extract() or extractall() on user-supplied or otherwise untrusted archives.
  • Search call sites for filter="data", filter="tar", and Python 3.14 code relying on the default filter.
  • Map deployed Python versions to the vendor advisory and applicable branch patch.
  • Use safe regression tests to confirm extracted files cannot escape the designated directory.
  • Review archive-processing systems for unexpected filesystem writes outside their extraction directories.
Prepared
Confidence
high
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-22: File access and web shell behavior lookup

File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2025-4517 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.4 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
13Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: yesTechnical Impact: total

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.4CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L3.95.5PSF

Vulnerability scoring details

Base CVSS 3.1 score

9.4Critical
CVSS 3.1 vector shape for CVE-2025-4517Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Python Software FoundationCPython0, 3.10.0, 3.11.0, 3.12.0, 3.13.0, 3.14.0a1unaffected
Weakness

CWE details

CWE-22

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.