CVE-2025-4517 (tarfile)

1. Vulnerability Overview

• Type of Vulnerability: Path traversal that allows arbitrary file writing.
• CVSS Score: Common Vulnerability Scoring System (CVSS) v3.1 score of 9.4 (Critical).
• Affected Component: The tarfile module in the Python standard library.
• Core Impact: When a program decompresses an untrusted .tar archive, an attacker can use a carefully crafted malicious archive to write files to any system path outside the target decompression directory. This can lead to the overwrite of sensitive files, the execution of unauthorized code, or even complete system compromise.

2. Technical Details

In the Python tarfile module, developers typically use the tarfile.TarFile.extractall() or tarfile.TarFile.extract() functions to decompress files.

To improve decompression security, Python introduced a filter parameter mechanism to filter out dangerous symbolic links. However, the core issue of CVE-2025-4517 lies in a design flaw in this filtering mechanism: when the filter parameter is set to "data" or "tar", the tarfile module does not properly validate and normalize the target paths of symbolic links or hard links.

Underlying Logic flaw: This is essentially a mismatch between path validation and path implementation. During the underlying processing (for example, when calling the operating system’s os.path.realpath() function to handle PATH_MAX limitations), if a malicious .tar file contains malicious entries pointing to directories such as ../../../../etc/passwd or other critical system directories, the tarfile module’s "data" filter cannot successfully intercept these attempts.

As a result, files that should be confined to a secure decompression directory can bypass these restrictions and be written to absolute system paths.

3. Affected Versions and Triggers

High-Risk Triggers: Code is at risk if the following conditions are met:

1. The archive is extracted from an external, untrusted source (such as user-uploaded files or downloaded resources from the internet).
2. The decompression function with a specific filter is called in the code: tarfile.TarFile.extractall(filter="data") or tarfile.TarFile.extract(filter="data").

Special Note: In Python 3.14 and later versions, the default value of filter was changed from "no filtering" to "data". This means that code relying on the new default behavior will also be affected even if no filter is explicitly specified.*

Python Versions with Fixed Vulnerability: The Python Software Foundation has fixed this issue in the following updates:

• Python 3.13.4
• Python 3.12.11
• Python 3.11.13
• Python 3.10.18
• Python 3.9.23

4. Practical Exploitation Scenarios

From the perspective of red team operations or penetration testing, this vulnerability is highly suitable for gaining initial access due to its low attack threshold and the lack of user interaction:

• Continuous Integration/Continuous Deployment (CI/CD) Pipelines: CI/CD runners frequently pull and extract build artifacts from repository mirrors or caches. The red team can deliver a malicious .tar package, which, upon extraction, will overwrite the runner’s SSH keys or environment variable configuration files.
• Machine Learning Pipelines: When loading external pre-trained model weight packages (usually packaged as .tar or .tar.gz files), if the automation scripts trust these files by default, the vulnerability can easily be exploited to alter the model loader’s execution logic.
• Automated Sandboxes and Plugin Ecosystems: During the automatic extraction and analysis of unknown files or the installation of third-party plugins, the sandbox environment may be compromised, leading to control of the host machine.

5. Mitigation and Workarounds

1. Upgrade: The most direct and effective solution is to upgrade the Python environment in the affected systems to the version with the corresponding security patches.
2. Temporary Code-level Mitigations:
   • Zero Trust Principle: Never blindly extract .tar packages from unknown sources before updating Python.
   • Strict Path Validation: If extraction is necessary, do not rely on the default protection provided by filter="data". Instead, implement your own rigorous path validation logic. For example, iterate through the objects returned by tarfile.TarFile.getmembers()and check iftarinfo.namecontains../`, or verify that the resulting absolute path remains within the expected secure folder.
   • Run with Reduced Permissions: Execute the Python process responsible for file extraction with minimal privileges. This way, even if unauthorized writes occur, the impact will be limited to users with those reduced permissions.