CVE-2025-4517: Arbitrary writes via tarfile realpath overflow
Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data".
You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile extraction filters documentation
Other sources
Arbitrary writes via tarfile realpath overflow
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.9.19-14 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.12.9-2 - Upgrade
Upgrade
debian/pypy3to a version that resolves this vulnerability.Fixed in 7.3.20+dfsg-2 - Upgrade
Upgrade
debian/python3.13to a version that resolves this vulnerability.Fixed in 3.13.4-1 - Upgrade
Upgrade
debian/jythonto a version that resolves this vulnerability.Fixed in 2.7.3+repack1-1 - Upgrade
Upgrade
debian/pypy3to a version that resolves this vulnerability.Fixed in 8.0.1+dfsg-1 - Upgrade
Upgrade
debian/python3.11to a version that resolves this vulnerability.Fixed in 3.11.2-6+deb12u8Fixed in 3.11.2-6+deb12u9 - Upgrade
Upgrade
debian/python3.13to a version that resolves this vulnerability.Fixed in 3.13.5-2+deb13u5Fixed in 3.13.18-1 - Upgrade
Upgrade
alpine/python3to a version that resolves this vulnerability.Fixed in 3.11.13-r0 - Upgrade
Upgrade
alpine/python3to a version that resolves this vulnerability.Fixed in 3.12.11-r0 - Upgrade
Upgrade
alpine/python3-tkinterto a version that resolves this vulnerability.Fixed in 3.12.11-r0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-4517?
CVE-2025-4517 is categorized as a high-severity vulnerability due to its ability to allow arbitrary filesystem writes.
How do I fix CVE-2025-4517?
To fix CVE-2025-4517, avoid using the TarFile.extractall() or TarFile.extract() methods with the filter parameter when handling untrusted tar archives.
Who is affected by CVE-2025-4517?
CVE-2025-4517 affects users of Python versions 3.12 and 3.14 that utilize the tarfile module to extract untrusted tar archives.
What is the exploitation vector for CVE-2025-4517?
CVE-2025-4517 can be exploited through untrusted tar files that are extracted using specific methods that do not validate paths properly.
Is there a workaround for CVE-2025-4517?
A potential workaround for CVE-2025-4517 is to validate and sanitize tar file contents before extraction to prevent unauthorized filesystem writes.