CVE-2025-4138
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk64th percentile - higher than 64% of all known CVEs
Summary
Vulnerability in Python's tarfile module allows the extraction filter to be ignored, enabling symlink targets outside the destination directory and modification of file metadata. Affects TarFile.extractall() or TarFile.extract() with filter='data' or 'tar'.
Risk Assessment
An attacker can supply a malicious tar archive that, when extracted, can overwrite files outside the target directory or modify their metadata, compromising system integrity.
Recommendation
Update Python to version 3.14 or later where the default filter is 'data', or use safer extraction filters.
Other vulnerabilities in Python tarfile module
See all- CVE-2026-11972High
The tarfile module in Python, when used with a file opened in streaming mode (mode="r|"), did not properly handle EOF, causing archive parsing to take exponentially longer.
- CVE-2024-12718Medium
A vulnerability in Python's tarfile module allows modifying file metadata or permissions outside the extraction directory when using filters 'data' or 'tar'. Affects Python 3.12+.
Original NVD description (English source)
Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information. Note that for Python 3.14 or later the default value of filter= changed from "no filtering" to `"data", so if you are relying on this new default behavior then your usage is also affected. Note that none of these vulnerabilities significantly affect the installation of source distributions which are tar archives as source distributions already allow arbitrary code execution during the build process. However when evaluating source distributions it's important to avoid installing source distributions with suspicious links.