CVE-2025-4517: Arbitrary writes via tarfile realpath overflow
Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data".
You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile extraction filters documentation
Other sources
Arbitrary writes via tarfile realpath overflow
— Microsoft
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-4517?
CVE-2025-4517 is categorized as a high-severity vulnerability due to its ability to allow arbitrary filesystem writes.
How do I fix CVE-2025-4517?
To fix CVE-2025-4517, avoid using the TarFile.extractall() or TarFile.extract() methods with the filter parameter when handling untrusted tar archives.
Who is affected by CVE-2025-4517?
CVE-2025-4517 affects users of Python versions 3.12 and 3.14 that utilize the tarfile module to extract untrusted tar archives.
What is the exploitation vector for CVE-2025-4517?
CVE-2025-4517 can be exploited through untrusted tar files that are extracted using specific methods that do not validate paths properly.
Is there a workaround for CVE-2025-4517?
A potential workaround for CVE-2025-4517 is to validate and sanitize tar file contents before extraction to prevent unauthorized filesystem writes.